Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

A computer in domain is randomly shut down by someone (he was caught once)!

He uses shutdown /s /f /t 0 /m \\computername in windows command line to accomplish this.

After the incident some computers randomly shut down several times a week, but maybe not by the same person.

Now the question is: Is it possible to detect / monitor if a computer was shut down remotely, and by who? (eg in Event Viewer)

share|improve this question

migrated from stackoverflow.com Mar 24 '13 at 14:59

This question came from our site for professional and enthusiast programmers.

1  
Maybe you can take a look in System Event log? I think it should contain some details about which process initiated the shutdown. –  Eugene S Mar 19 '13 at 8:56
    
@EugeneS - the system log does not contain any info related to shutdowns. –  armen Mar 27 '13 at 14:47
add comment

1 Answer

Try filtering the System log with the User32 event source, and 1074 Event ID (see more).

Unless you have enabled the Shutdown Event Tracker the "Other (Unplanned)" reason, is normal.

share|improve this answer
    
we are running Windows XP Pro on all machines, and the article says "This feature is not included in Windows XP Professional." –  armen Apr 1 '13 at 6:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.