We have a workstation at work that is on a domain. Every night at the same time it is shutting down by itself. We have stepped through the normal list of items that might request a shutdown and have come up with nothing. What we have been able to determine is that if we leave the workstation unplugged from the network it remains on overnight as expected. There is absolutely nothing in the event logs that indicate what is requesting this shutdown and the only events that occur near the shutdown event (6006) is over 45 minutes prior. There are no scheduled events, automatic updates are off, system is running just the default MS services, etc.
This is a request from the network to shutdown. There is also no easy way to test what server might be sending this request because we have dozens that are on the network at any one time.
Diagnosing a problem that only occurs once a day is not so easy especially when it only occurs at 11:33 at night.
Is there a way to determine what is requesting a shutdown on a workstation? Is there a script/program to log when a shutdown request is made and what program/source is requesting it?