Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Where can I find the last time the system was properly or improperly shutdown through the logs of Windows XP and Windows Server 2003?

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

Best Solution

You first need to enable the Shutdown Event Tracker. Steps for both Windows 2003 and XP are found here. Afterwards you just go to the event viewer and check it from there. An overview of it can be found here at Microsoft's TechNet Overview of Shutdown Event Tracker.

Work Around

If you are looking for that improper shutdown that has already accrued then that is a little harder. If you are able to find the GroupPolicy Opertional log then what you could do is look for key words: StartShell and EndShell. If you see two StartShell for the same session with a EndShell between it then you know that it was shutdown incorrectly. Windows wouldn't be able to EndShell for session if the power was suddenly interrupted.

Note: I found the workaround solution on a Windows 7 system. I don't know if XP or 2003 has this too.

share|improve this answer
    
"By default, Shutdown Event Tracker is enabled for all Windows Server 2003 operating systems and for Windows XP 64-Bit Edition Version 2003."..."By default, Shutdown Event Tracker is disabled in Windows XP Professional." –  Moab Dec 1 '10 at 2:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.