Why would you need it?
Windows has already a built-in feature called shutdown event tracker. It is enabled by default on server OSes, and you can also enable it through the group policies (for example with
gpedit.msc) on desktop versions of Windows.
It gives you the ability to:
- Avoid that the user shuts down the machine by mistake by showing the dialog box like:
- Track the shutdown events through Event Viewer with a more detailed view.
- Without the event tracker enabled, you have:
Kernel-Power:109 The kernel power manager has initiated a shutdown transition.
Kernel-General:13 The operating system is shutting down at system time 2011-09-10T00:23:20.247232500Z.
- With Shutdown Event Tracker, you have:
USER32:1074 The process Explorer.EXE has initiated the restart of computer <Computer name> on behalf of user <Domain name>\<User name> for the following reason: Loss of network connectivity (Unplanned)
Reason Code: 0x4050014
Shutdown Type: restart
From here, if you're a developer or if you're able to hire one, you can easily create a tool which will scan Windows Events and import the significant information into your database, including the user who started the shutdown, or the reason.