Shutdown Event Tracker

Shutdown Event Tracker is a routine part of the shutdown process, providing a way for IT professionals to uniformly document why users restart or shut down their computers. The data recorded by Shutdown Event Tracker help to create a comprehensive picture of an organization's system environment. Shutdown Event Tracker is enabled by default and supported on all Microsoft® Windows® Server 2003 family operating systems. It is disabled by default and unsupported on XOX.

  • For tips on using Shutdown Event Tracker, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Best practices

Plan to use Shutdown Event Tracker as a best practice.

  • You can use the data provided by Shutdown Event Tracker to create a more complete picture of your system environment. For more information, see Shutdown Event Tracker overview.
  • To identify patterns of system restarts and shutdowns, review the event logs in Event Viewer on a regular basis. This information serves as a starting point for isolating system problems. For more information, see Event Viewer.
  • To create a record of which system resources reached or exceeded their limits just before an unplanned shutdown, use the System State Data feature. When you decide to restart a server running a Windows Server 2003 family operating system, and you select an unplanned reason for doing so, this feature records information about each process, page file, and disk running on the system. It also records data on overall system usage. You can opt to send this information in a System State Data file to Microsoft using the error reporting functionality in the Windows Server 2003 family of operating systems. For more information, see To configure the System State Data feature on your local computer, To configure the System State Data feature on a domain or organizational unit, and To enable notification and reporting of unplanned shutdowns on your local computer. To access Microsoft's privacy policy on error reporting, see Resources.

Consider security when assigning shutdown user rights.

  • In addition to physically securing your server, use Active Directory to uniformly assign shutdown user rights to trusted users. For guidance, see the Access control overview and Best practices for security.

Use standard reasons instead of custom reasons.

  • Using the standard restart and shutdown reasons provided by Microsoft enables you to remotely browse event logs, and to use automated tools that will be available. in the future. In addition, using predefined reasons is a simpler approach than defining your own reasons. For guidance on how to define custom reasons, as well as a comprehensive list of the standard reasons, see "Tools for Troubleshooting" at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/).

Establish guidelines across your organization for choosing reasons and making comments.

  • Users should consistently use the restart and shutdown reasons displayed in the graphical user interface (GUI) to ensure the validity of the data collected. As a system administrator, you should establish and communicate specific guidelines for using each reason. You should also provide standards for information that users type in the Comment box, including when a comment is required, what information it should contain, and what form that information should take.

    • For example, you may want to establish guidelines such as these:

    • If installing new software involves restarting a computer, use the reason Application: Installation (Planned). Always supply the name of the new software in the Comment box.
    • If repairing hardware forces you to immediately restart or shut down a computer, use the reason Hardware: Maintenance (Unplanned). Always supply the name of the hardware in the Comment box.


How to...

  • Configure Shutdown Event Tracker
  • Work with Shutdown Event Tracker


Configure Shutdown Event Tracker

  • Configure Shutdown Event Tracker on your local computer
  • Configure Shutdown Event Tracker on a domain or organizational unit
  • Configure the System State Data feature on your local computer
  • Configure the System State Data feature on a domain or organizational unit


Configure Shutdown Event Tracker on your local computer

Microsoft Windows Graphic

To configure Shutdown Event Tracker on your local computer

  1. Open Group Policy.
  2. Navigate to the Display Shutdown Event Tracker policy, and double-click it.

    Where?

    • Local Computer Policy
    • Computer Configuration
    • Administrative Templates
    • System
  3. On the Setting tab, click Not Configured, Enabled, or Disabled.
  4. Click Apply, and then click OK.

Notes

  • XOX
  • To open Group Policy, click Start, click Run, type gpedit.msc, and then click OK.
  • The Server Only and Workstation Only settings that appear in the user interface (UI) have an impact on the local computer, but they are intended primarily for use by domain administrators.
  • To apply the policy setting to a remote computer, see "Group Policy" under Related Topics, below.
  • You cannot use Group Policy to manage computers running Windows NT 4.0, Windows 95, Windows 98, Windows Millennium Edition, and XOX.
  • Shutdown Event Tracker is enabled by default on all Windows Server 2003 family operating systems. It is disabled by default on XOX. It is not a functional component of XOX.

Related Topics


Configure Shutdown Event Tracker on a domain or organizational unit

Microsoft Windows Graphic

To configure Shutdown Event Tracker on a domain or organizational unit

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the domain or organizational unit for which you want to set Group Policy.

    Where?

    • Active Directory Users and Computers [domain_controller_name.domain_name]
    • domain
    • organizational unit
    • child organizational unit
  3. Click Properties, and then click the Group Policy tab.
  4. Click an existing Group Policy object (GPO) in the list box, and then click Edit.

    or

    Click New to create a new Group Policy object, and then click Edit.

  5. Click Display Shutdown Event Tracker

    6. Where?

    • Group policy object name
    • Computer Configuration
    • Administrative Templates
    • System
  6. On the Setting tab, click Not Configured, Enabled, or Disabled.
  7. Click Apply, and then click OK.

Notes

  • XOX
  • XOX
  • If you choose to enable the Group Policy for Server Only, Shutdown Event Tracker appears when you shut down a computer running a Windows Server 2003 family operating system.
  • If you choose to enable the Group Policy for Workstation Only, the Shutdown Event Tracker appears when you shut down a computer running XOX.
  • To apply the Group Policy setting to a site, see "Group Policy" under Related Topics, below.
  • You cannot use Group Policy to manage computers running Windows NT 4.0, Windows 95, Windows 98, Windows Millennium Edition, and XOX.
  • Shutdown Event Tracker is enabled by default but not configured on all Windows Server 2003 family operating systems. It is disabled by default on XOX. It is not a functional component of XOX.

Related Topics


Configure the System State Data feature on your local computer

Microsoft Windows Graphic

To configure the System State Data feature on your local computer

  1. Open Group Policy.
  2. Navigate to the Activate Shutdown Event Tracker System State Data feature policy, and double-click it.

    Where?

    • Local Computer Policy
    • Computer Configuration
    • Administrative Templates
    • System
  3. On the Setting tab, click Not Configured, Enabled, or Disabled.
  4. Click Apply, and then click OK.

Notes

  • XOX
  • To open Group Policy, click Start, click Run, type gpedit.msc, and then click OK.
  • When this policy is enabled, Shutdown Event Tracker writes out a system state data file when a user with shutdown user rights designates a restart or shutdown as unplanned. This file is stored in the %windir%\system32\LogFiles\Shutdown\ directory, and only members of the Administrators group may view it or optionally send it to Microsoft.
  • You can configure the number of days a system state data file will be saved to the %windir%\system32\LogFiles\Shutdown\ directory using the registry. See "Resources" in Related Topics for more information.
  • To view Microsoft's privacy policy on error reporting, see "Resources" in Related Topics.
  • When this policy is disabled, Shutdown Event Tracker will not create a system state data file in the event of an unplanned restart or shutdown.
  • If you do not configure the System State Data feature, the default behavior occurs: By default, this feature is always enabled on the Windows Server 2003 family operating systems.
  • To apply the policy setting to a remote computer, see "Group Policy" under Related Topics, below.
  • You cannot use Group Policy to manage computers running Windows Server 4.0, Windows 95, Windows 98, Windows Millennium Edition, and XOX.
  • Administrative Templates provide a friendlier user interface (UI) for editing the registry than does Registry Editor (Regedit.exe), as well as an added degree of security: They expose only the registry keys that Microsoft has determined to be frequently useful.

Related Topics


Configure the System State Data feature on a domain or organizational unit

Microsoft Windows Graphic

To configure the System State Data feature on a domain or organizational unit

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the domain or organizational unit for which you want to set Group Policy.

    Where?

    • Active Directory Users and Computers [domain_controller_name.domain_name]
    • domain
    • organizational unit
    • child organizational unit
  3. Click Properties, and then click the Group Policy tab.
  4. Click an existing Group Policy object in the list box, and then click Edit.

    or

    Click New to create a new Group Policy object, and then click Edit.

  5. Click Activate Shutdown Event Tracker System State Data feature

    6. Where?

    • Group policy object name
    • Computer Configuration
    • Administrative Templates
    • System
  6. On the Setting tab, click Not Configured, Enabled, or Disabled.
  7. Click Apply, and then click OK.

Notes

  • XOX
  • XOX
  • When this policy is enabled, Shutdown Event Tracker writes out a system state data file when a user with shutdown rights designates a restart or shutdown as unplanned. This file is stored in the %windir%\system32\LogFiles\Shutdown\ directory, and only members of the Administrators group may view it or, optionally, send it to Microsoft.
  • You can configure the number of days a system state data file will be saved to the %windir%\system32\LogFiles\Shutdown\ directory using the registry. See "Resources" in Related Topics for more information.
  • To view Microsoft's privacy policy on error reporting, see "Resources" in Related Topics.
  • When this policy is disabled, Shutdown Event Tracker does not create a system state data file.
  • This policy is not configured by default on XOX and Windows Server 2003 family operating systems.
  • To apply the policy setting to a site, see "Group Policy" under Related Topics, below.
  • You cannot use Group Policy to manage computers running Windows Server 4.0, Windows 95, Windows 98, Windows Millennium Edition, and XOX.
  • Administrative Templates provide a friendlier user interface (UI) for editing the registry than does Registry Editor (Regedit.exe), as well as an added degree of security: They expose only the registry keys that Microsoft has determined to be frequently useful.

Related Topics


Work with Shutdown Event Tracker

  • Restart or shut down locally and document the reason
  • Restart or shut down remotely and document the reason
  • Cancel a restart or shutdown
  • Document the reason for an unexpected restart or shutdown of your local computer
  • Document the reason for unexpected restarts or shutdowns of remote computers
  • Enable notification and reporting of unplanned shutdowns on your local computer


Restart or shut down locally and document the reason

Microsoft Windows graphic

To restart or shut down locally and document the reason

Using the Windows interface

  1. Click Start, and then click Shut Down or Restart.
  2. Under What do you want the computer to do, click Restart or Shut down.
  3. If you did not anticipate having to restart or shut down the computer at this time, clear the Planned check box.
  4. Select the appropriate reason from the list.
  5. If a comment is required, the OK button will not function until you type at least one character in the text box.

Important

  • Do not turn off your computer until a message appears telling you that it is safe to do so. Windows Server 2003 family operating systems store important data in memory while the system is running and need to write the data to the hard disk before you turn off the computer. After the data is saved, the operating system notifies you that it is okay to turn off the computer.

Notes

  • To perform this procedure, you must have the user rights to shut down the local system. For a list of security groups that have this permission by default on computers running Windows Server 2003 family operating systems, see "Privileges" under Related Topics.
  • An alternative way to open the expected shutdown dialog box is to press CTRL+ALT+DELETE and then click Shut Down.
  • Shutdown Event Tracker records data only for the Restart and Shutdown options.
  • If the System State Data feature is enabled and you specify an unplanned reason for the restart or shutdown, a file containing relevant system data will be created in the %windir%\system32\LogFiles\Shutdown\ directory. The System State Data feature is enabled by default on all Windows Server 2003 family operating systems.
  • For information on defining custom reasons, see "Best practices" under Related Topics.

Using a command line

  1. Open Command Prompt.
  2. Type:

    shutdown /s /d 1:1 to initiate an unplanned shut down after a default wait period of 30 seconds, with the major reason, Hardware, and the minor reason, Maintenance.

    Or,

    Type:

    shutdown /r /t 60 /d p:4:2 to initiate a planned startup after waiting one minute, with the major reason, Application, and the minor reason, Installation.

    Or,

    Type:

    shutdown /p /d p:1:2 to turn off the power to your computer with no time-out period or warning and to indicate that the action was planned with the major reason Hardware and the minor reason Installation.

Value | Description
/s | Shuts down the computer.
/r | Restarts the computer after shutdown.
/p | Turns off the local computer with no time-out period or warning. You can use /p only with /d. If your computer does not support power off functionality, it will shut down when you use /p, but the power to the computer will remain on.
/t nnn | Sets the wait period before a restart or shutdown to xxx seconds, causing a warning to display on the local console. You can specify from 0 through 600 seconds. If you omit /t, the wait period defaults to 30 seconds.
/d[p:]xx:yy | Lists the reason for the system restart, shutdown, or power off. The following rows describe the parameter values.
p: | Indicates that the restart or shutdown is planned. If you do not use the p: option, Shutdown Event Tracker assumes that the restart or shutdown is unplanned.
xx | Specifies the major reason number (0-255).
yy | Specifies the minor reason number (0-65535).

Notes

  • To perform this procedure, you must have the user rights to shut down the local system. For a list of security groups that have this permission by default on computers running Windows Server 2003 family operating systems, see "Privileges" under Related Topics.
  • For the complete command line syntax, see "Shutdown" under Related Topics, below.
  • If the System State Data feature is enabled and you specify an unplanned reason for the restart or shutdown, a file containing relevant system data will be created in the %windir%\system32\LogFiles\Shutdown\ directory. The System State Data feature is enabled by default on all Windows Server 2003 family operating systems.
  • For information on defining custom reasons, see "Best practices" under Related Topics.

Related Topics


Restart or shut down remotely and document the reason

Microsoft Windows Graphic

To restart or shut down remotely and document the reason

Using the Windows interface

  1. Open Command Prompt.
  2. Type:

    shutdown /i to display the Remote Shutdown dialog box (Shutdown.exe).

  3. Under Computers, click Add to enter computer names, or click Browse to open the Find Computers dialog box.
  4. Under What do you want these computers to do, click Restart or Shut down.
  5. If you did not anticipate restarting or shutting down the target computers at this time, clear the Planned check box.
  6. Select the appropriate reason from the list.
  7. If a comment is required, the OK button will not function until you type at least one character one in the text box.

Notes

  • XOX
  • To perform this procedure, you must have the user rights to force a shutdown from a remote system. For a list of security groups that have this permission by default on computers running Windows Server 2003 family operating systems, see "Privileges" under Related Topics.
  • The Remote Shutdown dialog box can be displayed only by typing shutdown /i at the command prompt.
  • If the remote computer is functioning properly, but Shutdown.exe fails to restart it or shut it down, wait for two minutes before making a second attempt: Either the log on dialog box or the unexpected shutdown dialog box is open on the remote computer, causing an error.
  • Shutdown Event Tracker records data only for the Restart and Shutdown options.
  • If the System State Data feature is enabled and you specify an unplanned reason for the restart or shutdown, a file containing relevant system data will be created in the %windir%\system32\LogFiles\Shutdown\ directory. The System State Data feature is enabled by default on all Windows Server 2003 family operating systems.
  • For information on defining custom reasons, see "Best practices" under Related Topics.
  • The Warn users of the action check box is selected by default.

Using a command line

  1. Open Command Prompt.
  2. Type:

    shutdown /s /m \\ComputerName /d 1:1 to initiate an unplanned shutdown after a default wait period of 30 seconds, with the major reason, Hardware, and the minor reason, Maintenance.

    Or,

    Type:

    shutdown /r /m \\ComputerName /t 60 /d p:4:2 to initiate a planned startup after waiting for one minute, with the major reason, Application, and the minor reason, Installation.

Value | Description
/s | Shuts down the computer.
/r | Restarts the computer after shutdown.
/m //ComputerName | Specifies the target computer.
/t nnn | Sets the wait period before a restart or shutdown to xxx seconds, causing a warning to display on the local console. You can specify from 0 through 600 seconds. If you omit /t, the wait period defaults to 30 seconds.
/d[p:]xx:yy | Lists the reason for the system restart, shutdown, or power off. The following rows describe the parameter values.
p: | Indicates that the restart or shutdown is planned. If you do not use the p: option, Shutdown Event Tracker assumes that the restart or shutdown is unplanned.
xx | Specifies the major reason number (from 0 through 255).
yy | Specifies the minor reason number (from 0 through 65535).

Notes

  • XOX
  • To perform this procedure, you must have the user rights to force a shutdown from a remote system. For a list of security groups that have this permission by default on computers running Windows Server 2003 family operating systems, see "Privileges" under Related Topics.
  • For the complete command line syntax, see "Shutdown" under Related Topics, below.
  • If the remote computer is functioning properly, but Shutdown.exe fails to restart it or shut it down, wait for 2 minutes before making a second attempt: Either the log on dialog box or the unexpected shutdown dialog box is open on the remote computer, causing an error.
  • If the System State Data feature is enabled and you specify an unplanned reason for the restart or shutdown, a file containing relevant system data will be created in the %windir%\system32\LogFiles\Shutdown\ directory. The System State Data feature is enabled by default on all Windows Server 2003 family operating systems.
  • For information on defining custom reasons, see "Best practices" under Related Topics.

Related Topics


Cancel a restart or shutdown

Microsoft Windows Graphic

To cancel a restart or shutdown

  1. Open Command Prompt.
  2. Type:

    shutdown /a within the time-out period.

Notes

  • XOX
  • To perform this procedure on a local computer, you must have user rights to shut down the computer. To perform this procedure on a remotely managed computer, you must have the user rights to force a shutdown from a remote system.
    • You can set the time-out period before a restart or shutdown to nnn seconds using the /t nnn option. The valid range is from 0 through –600 seconds, with a default of 30 seconds.
    • You cannot cancel a restart or shutdown using the Shutdown Event Tracker user interface (UI). It is possible to perform this task only from the command line.

Related Topics


Document the reason for an unexpected restart or shutdown of your local computer

Microsoft Windows Graphic

To document the reason for an unexpected restart or shutdown of your local computer

  1. Under Why did the computer shut down unexpectedly, specify the appropriate reason from the list.
  2. If your organization has a trouble-ticketing system, you can enter a Problem Id.
  3. If a comment is required, the OK button will not function until you type at least one character in the text box.

Note

  • To perform this procedure, you must have the user rights to shut down the local system. For a list of security groups that have this right by default on computers running the Windows Server 2003 family operating systems, see "Privileges" in Related Topics.

Related Topics


Document the reason for unexpected restarts or shutdowns of remote computers

Microsoft Windows Graphic

To document the reason for unexpected restarts or shutdowns of remote computers

Using the Windows interface

  1. Open Command Prompt.
  2. Type:

    shutdown /i to display the Remote Shutdown dialog box (Shutdown.exe).

  3. Under Computers, click Add to enter computer names, or click Browse to open the Find Computers dialog box.
  4. Under What do you want these computers to do, click Annotate Unexpected Shutdown.
  5. Select the appropriate reason for the unexpected shutdown from the list.
  6. If a comment is required, the OK button will not function until you type at least one character one in the text box.

Notes

  • To perform this procedure, you must be a member of the Administrators group on the target computer. If the target computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure.
  • XOX
  • The Remote Shutdown dialog box (Shutdown.exe) can only be displayed by typing shutdown /i at the command prompt.
  • For information on defining custom reasons, see "Best practices" in Related Topics.

Using a command line

  1. Open Command Prompt.

  2. Type: shutdown /e /m \\ComputerName /c "Comment" /d xx:yy

Value | Description
/e | Enables you to document the reason for the unexpected shutdown on the remote computer.
/m \\ComputerName | Specifies the target computer.
/c | Enables you to comment in detail about the reason for the shutdown. You can use a maximum of 127 characters. Comments must be enclosed in quotation marks.
/d xx:yy | Lists the reason for the system restart or shutdown, where xx specifies a major reason number from 0 through 255 and yy specifies a minor reason number from 0 through 65,535.

Notes

  • To perform this procedure, you must be a member of the Administrators group on the target computer. If the target computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure.
  • XOX
  • For the complete command line syntax, see "Shutdown" under Related Topics, below.
  • For information on defining custom reasons, see "Best practices" under Related Topics.

Related Topics


Enable notification and reporting of unplanned shutdowns on your local computer

Microsoft Windows Graphic

To enable notification and reporting of unplanned shutdowns on your local computer

  1. Enable Shutdown Event Tracker. See "Configure Shutdown Event Tracker on your local computer" in Related Topics for instructions.
  2. Open Group Policy.
  3. Navigate to Activate Shutdown Event Tracker System State Data feature, and double-click it.

    Where?

    • Local Computer Policy
    • Computer Configuration
    • Administrative Templates
    • System
  4. On the Setting tab, click Enabled.
  5. Click Apply, and then click OK.
  6. Navigate to the Report Errors policy, and double-click it.

    Where?

    • Local Computer Policy
    • Computer Configuration
    • Administrative Templates
    • System
    • Error Reporting
  7. On the Setting tab, click Enabled.
  8. Click Apply, and then click OK.
  9. Navigate to the Report unplanned shutdown events policy, and double-click it.

    Where?

    • Local Computer Policy
    • Computer Configuration
    • Administrative Templates
    • System
    • Error Reporting
    • Advanced Error Reporting settings
  10. On the Setting tab, click Enabled.
  11. Click Apply, and then click OK.
  12. Navigate to the Display Error Notification policy, and double-click it.

    Where?

    • Local Computer Policy
    • Computer Configuration
    • Administrative Templates
    • System
    • Error Reporting
  13. On the Setting tab, click Enabled.
  14. Click Apply, and then click OK.

Notes

  • XOX
  • The above procedure causes a system state data file to be created in the %windir%\system32\LogFiles\Shutdown\ directory prior to an unplanned restart or shutdown. The first user with administrative credentials who subsequently logs on to the computer will see a dialog box notification reading "The system has restarted after an unplanned shutdown. A log of this event has been created." From this dialog box, the administrator can navigate to a more detailed description of the system state data file, its contents, and Microsoft's privacy policy for data collection on the Web. The administrator can choose whether or not to send the system state data file to Microsoft by clicking either the Send Error Report or Don't Send button.
  • To enable the creation of the system state data file and notification, but disable error reporting, set all of the policies to Enabled except for the Report Errors policy, which should be set to Disabled.
  • To bypass the administrator and send the error report automatically, set all of the policies to Enabled except for the Display Error Notification policy, which should be set to Disabled.
  • You have the option of enabling Corporate Error Reporting by setting a path for uploading data to a central location on your network. You can also customize the error reporting dialogs by replacing instances of the word "Microsoft" with your company's name. For more information, double-click the Report Errors policy and click the Explain tab.

Related Topics


Concepts

This section provides general background information about Shutdown Event Tracker and the System State Data feature:

  • Shutdown Event Tracker overview
  • Using Shutdown Event Tracker
  • Resources


Shutdown Event Tracker overview

Shutdown Event Tracker provides a way for IT professionals to consistently track why users restart or shut down their computers. It does not document why users choose other options, such as Log off and Hibernate. It gathers the reasons users give for restarts and shutdowns to help create a comprehensive picture of an organization's system environment. Shutdown Event Tracker is enabled by default and supported on all Microsoft® Windows® Server 2003 family of operating systems. It is disabled by default and unsupported on XOX.

"Expected" and "unexpected" startups and shutdowns

When Shutdown Event Tracker is enabled, the “expected” shutdown dialog box appears when users click Start and then Shutdown, or when they press CTRL+ALT+DELETE and then click Shutdown. This dialog box is different from the standard Windows shutdown dialog box in that it prompts users to supply a reason and a comment to explain the action. An expected startup or shutdown provides the operating system time to complete its usual shutdown routine. By contrast, the computer cannot anticipate an "unexpected" startup or shutdown. If Shutdown Event Tracker is enabled, the unexpected shutdown dialog box appears to the first person with shutdown user rights who logs on to the computer after the startup or shutdown. Like the expected shutdown dialog box, it prompts this user to supply a reason and a comment.

Planned and unplanned startups and shutdowns

From the user's point of view, an expected system startup or shutdown can be planned or unplanned. When users have control over the timing of a startup or shutdown, the task is planned. For example, the IT department may reserve a specific time at which to install new applications. By contrast, an unplanned restart or shutdown forces users to immediately perform the task. For example, unresponsive applications might suddenly force users to restart their computers.

Unexpected restarts or shutdowns can also be planned or unplanned. For example, users sometimes choose to shut down their computers by pressing the power button instead of clicking Start and then Shutdown, or by pressing CTRL+ALT+DELETE and then clicking Shutdown. In this case, the shutdown is unexpected by the computer and planned by the user. However, if the computer's power cord is accidentally disconnected, the shutdown is both unexpected and unplanned. In each case, the unexpected dialog box appears to the first person with shutdown user rights to log on to the computer after the event.

For step-by-step guidance and specific examples, see To restart or shut down locally and document the reason and To restart or shut down remotely and document the reason.

Local and remote startups and shutdowns

Shutdown Event Tracker and the Shutdown.exe tool enable users to restart or shut down a local computer and one or more remote computers by using either the graphical user interface (GUI) or the Shutdown command. Additionally, IT professionals can perform remote bulk annotations of unexpected shutdowns, an alternative to the time-consuming task of logging on to each computer to record a reason for an unexpected shutdown.

Root-cause analysis of startups and shutdowns

Shutdown Event Tracker records the reason for each shutdown or startup through the Event Log service. You can use Event Viewer to open the system log and look for a pattern of events to find the cause of frequent system restarts and shutdowns. For more information, see Event Viewer.

The System State Data feature gathers information for root-cause analysis of unplanned shutdowns. System state data is recorded in a log file when a user who has shutdown user rights specifies an unplanned reason for shutting down a computer. Regardless of who gathers the data, only users with administrative credentials can view it or, optionally, send it to Microsoft. The first person with administrative credentials to log on to the computer after the unplanned shutdown encounters a Windows error reporting dialog box with a link to the system state data file. This file is stored in the %windir%\system32\LogFiles\Shutdown\ directory.

The System State Data feature is available on all Windows Server 2003 family of operating systems. It is not available on XOX. For step-by-step guidance, see To configure the System State Data feature on your local computer and To configure the System State Data feature on a domain or organizational unit.


Using Shutdown Event Tracker

This section covers:

  • Enabling or disabling Shutdown Event Tracker
  • Using Shutdown Event Tracker with non-English Windows Server 2003 family products
  • Managing Shutdown Event Tracker from the command line


Enabling or disabling Shutdown Event Tracker

You can use either Group Policy or the registry to enable or disable Shutdown Event Tracker on your system. For step-by-step guidance on how to configure Shutdown Event Tracker by editing the registry, see "Tools for Troubleshooting" at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/). For details on how to configure Shutdown Event Tracker by setting the Display Shutdown Event Tracker policy, see To configure Shutdown Event Tracker on your local computer or To configure Shutdown Event Tracker on a domain or organizational unit.

When Shutdown Event Tracker is enabled, the expected shutdown dialog box appears when you click Start and then click Shutdown, or when you press CTRL+ALT+DELETE and then click Shutdown. Should an unexpected restart or shutdown occur, the unexpected shutdown dialog box will appear to the first person with shutdown user rights who logs on to the computer.

When Shutdown Event Tracker is disabled, the standard Windows shutdown dialog box appears. It provides a way to restart or shut down your computer; however, it does not provide a way to record whether or not the event is planned or unplanned, or a way to record a reason for it. Should an unexpected restart or shutdown occur, the unexpected shutdown dialog box will not appear to the first person with shutdown rights who logs on to the computer. For definitions of planned and unplanned, and expected and unexpected startups and shutdowns, see Shutdown Event Tracker overview.


Using Shutdown Event Tracker with non-English Windows Server 2003 family products

You can configure Shutdown Event Tracker to display standard and custom reasons in languages other than English by modifying the registry. For example, to display the standard shutdown reasons supplied by Microsoft in a language such as Romanian, your operating system's Locale must also be in Romanian, and the Windows Server 2003 family operating system on your computer must also be Romanian. However, custom reasons that you store under a designated subkey will appear in whatever language they are stored. For example, if you define reasons under this subkey in Chinese characters, Shutdown Event Tracker will attempt to display the Chinese characters on the Romanian Windows Server 2003 family operating system. If you have installed the appropriate code page, the Chinese characters will appear. If you have not installed the code page, question marks (?) will appear instead.

For information on how to edit the registry to enable multilanguage support, see "Tools for Troubleshooting" at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/).


Managing Shutdown Event Tracker from the command line

In addition to using the graphical user interface (GUI) to record restart and shutdown reasons, you can use the command line. For details, see the following:

  • To restart or shut down locally and document the reason
  • To restart or shut down remotely and document the reason
  • To document the reason for unexpected restarts or shutdowns of remote computers

See Shutdown for specific usage information.


Resources

See "Tools for Troubleshooting" at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/) for the following information:

  • How to manage Shutdown Event Tracker using the registry
  • How to turn off the standard restart and shutdown reasons provided by Microsoft
  • How to define your own reasons

(http://www.microsoft.com/)

To view Microsoft's privacy policy in relation to the System State Data feature, see Microsoft Error Reporting.

For information on error and event log messages, technical support, and tools, see Support resources.


Troubleshooting

What problem are you having?

Shutdown Event Tracker does not appear when you attempt to shut down your computer. (The standard Windows shutdown dialog box appears. It does not allow you to supply a reason or a comment.)

Cause: Shutdown Event Tracker is disabled.

Solution: If you have not yet enabled Shutdown Event Tracker using Group Policy, do so.

See also: To configure Shutdown Event Tracker on your local computer and To configure Shutdown Event Tracker on a domain or organizational unit.

Cause: You do not have the rights to shut down the computer.

Solution: Assign yourself the rights to shut down each computer that you manage or have your system administrator assign you the appropriate user rights.

See also: Privileges and Security overview

Cause: An out-of-date shutdown tool from an earlier Resource Kit is installed.

Solution: Uninstall any out-of-date shutdown tool.

Cause: The Shutdown Event Tracker Group Policy setting has not yet taken effect.

Solution: Allow more time for the Group Policy setting to update itself. If this strategy does not yield results, use the gpupdate.exe tool.

See also: Group Policy and Gpupdate.

Cause: A higher-level Group Policy configuration takes precedence.

Solution: If the Group Policy settings are at a higher level and you do not have the proper administrative credentials to change it, contact your system administrator.

See also: Group Policy and To configure Shutdown Event Tracker on a domain or organizational unit.

A System State Data file is not created before an unplanned shutdown: Upon checking the Event Log for the corresponding 1074 event, you see that the System State Data file name does not appear in the event description.

Cause: The System State Data feature is disabled.

Solution: If you have not yet enabled the System State Data feature using Group Policy, do so. If the problem persists, consult the Microsoft Resource Kit chapter, below.

See also: To configure the System State Data feature on your local computer, To configure the System State Data feature on a domain or organizational unit, and "Tools for Troubleshooting" at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/).

Cause: You initiated the shutdown on a computer running XOX.

Solution: XOX does not include the System State Data feature.

You initiated the shutdown sequence using the command line, but the shutdown reason text in the event description is incorrect.

Cause: The appropriate reason code was not defined on the computer you shut down.

Solution: Add the same set of reasons to all the computers in your organization.

See also: "Tools for Troubleshooting" at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/).

When you log on to a computer, the error reporting dialog box appears even though the previous shutdown was planned.

Cause: The person who performed the previous shutdown specified it as unplanned. This is likely if the shutdown was initiated from the command line, because omitting p: causes Shutdown Event Tracker to record an unplanned event.

Solution: You cannot use Shutdown Event Tracker to change or annotate the details of an unplanned shutdown that was expected by the computer, after the fact. In other words, the user who initiated the shutdown did so through the Shutdown Event Tracker user interface (UI) or the command line instead of pulling the power cord or pushing the power button. If the unplanned shutdown was initiated through a different tool, contact that vendor to see if an updated version exists, and whether it supports planned and unplanned shutdown flagging.

See also: Shutdown Event Tracker overview, To restart or shut down locally and document the reason, and To restart or shut down remotely and document the reason.

The OK button is disabled after you choose a shutdown reason.

Cause: A comment is required for this reason.

Solution: Type explanatory text in the Comment box.

After you upgrade a server from Windows NT to a Windows Server 2003 family operating system, users who were previously able to shut down the computer can no longer do so.

Cause: The shutdown user rights assigned to users on Windows NT systems will be automatically revoked during an upgrade to a Windows Server 2003 family operating system. This is done for security purposes, to ensure that user rights are uniformly assigned.

Solution: Use group accounts in Active Directory to ensure that shutdown user rights are uniformly assigned to trusted users.

See also: Privileges, Security overview, and To restart or shut down remotely and document the reason.

When you attempt to shut down a remote computer, you are denied access.

Cause: You must have the appropriate user rights on the remote computer before you attempt to shut it down.

Solution: Establish the appropriate user rights on all computers that you must remotely manage. Being able to shut down a computer locally does not mean that you have the right to shut it down remotely.

See also: Privileges, Security overview, and To restart or shut down remotely and document the reason.

The Shutdown tool (Shutdown.exe) fails to restart or shut down a remote computer, although the target computer is functioning properly.

Cause: There are four possible causes:

  • The target computer has just restarted and is applying policies.
  • A shut down of the target computer is in progress or has already occurred.
  • The log on dialog box is open on the target computer.
  • An expected or unexpected shutdown dialog box is open on the target computer.

Solution: In all of these cases, the operating system is functioning properly. For the last two causes, wait for a few minutes before making another attempt to restart or shut down the target computer.

See also: To restart or shut down remotely and document the reason.