Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A computer in domain is randomly shut down by someone (he was caught once)!

He uses shutdown /s /f /t 0 /m \\computername in windows command line to accomplish this.

After the incident some computers randomly shut down several times a week, but maybe not by the same person.

Now the question is: Is it possible to detect / monitor if a computer was shut down remotely, and by who? (eg in Event Viewer)

share|improve this question

migrated from Mar 24 '13 at 14:59

This question came from our site for professional and enthusiast programmers.

Maybe you can take a look in System Event log? I think it should contain some details about which process initiated the shutdown. – Eugene S Mar 19 '13 at 8:56
@EugeneS - the system log does not contain any info related to shutdowns. – armen Mar 27 '13 at 14:47

Try filtering the System log with the User32 event source, and 1074 Event ID (see more).

Unless you have enabled the Shutdown Event Tracker the "Other (Unplanned)" reason, is normal.

share|improve this answer
we are running Windows XP Pro on all machines, and the article says "This feature is not included in Windows XP Professional." – armen Apr 1 '13 at 6:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.