Logs for Windows XP and Windows Server 2003?

Question

Where can I find the last time the system was properly or improperly shutdown through the logs of Windows XP and Windows Server 2003?

Answer 1

Best Solution

You first need to enable the Shutdown Event Tracker. Steps for both Windows 2003 and XP are found here. Afterwards you just go to the event viewer and check it from there. An overview of it can be found here at Microsoft's TechNet Overview of Shutdown Event Tracker.

Work Around

If you are looking for that improper shutdown that has already accrued then that is a little harder. If you are able to find the GroupPolicy Opertional log then what you could do is look for key words: StartShell and EndShell. If you see two StartShell for the same session with a EndShell between it then you know that it was shutdown incorrectly. Windows wouldn't be able to EndShell for session if the power was suddenly interrupted.

Note: I found the workaround solution on a Windows 7 system. I don't know if XP or 2003 has this too.