Section 10.5: The Shutdown Event Tracker

You can use the Shutdown Event Tracker to monitor the shutdowns on their servers. A computer can be shut down for various reasons that fall into two broad categories: expected and unexpected shutdowns. An expected shutdown is one that you anticipate in response to a particular action. An expected shutdown can be either planned or unplanned. System administrators have control over a planned shutdown while an application on the server can cause an unplanned shutdown and restart automatically. An unexpected shutdowns cause the Windows Server 2003 systems to shut down unexpectedly. This could be due to nonapplications or operating system functions, such as a power failure.

In Windows Server 2003, shutdown events are controlled by the Shutdown Event Tracker and shutdown command-line utility. The Shutdown Event Tracker tool is enabled by default but can be configured by using the Group Policy Object Editor. To configure Shutdown Event Tracker, do the following:

• Click on the START button to display the Start Menu
• Click on RUN
• In the Run text box, type gpedit.msc
• Then click OK to activate the Group Policy Object Editor with the Local Computer Policy displayed
• In the console tree, expand the local computer policy node
• Expand the computer configuration node
• Expand the administrative templates node
• Expand the system node
• Select DISPLAY SHUTDOWN EVENT TRACKER
• Double-click the DISPLAY SHUTDOWN EVENT TRACKER policy
• Select the desired configuration options
• Then click OK

If the Display Shutdown Event Tracker policy is configured to display the Shutdown Event Tracker, the Shutdown Windows dialog box is displayed whenever the system shuts down.

Note: The Shutdown Event Tracker does not record Logoff or Hibernate actions. It only logs complete shutdowns of the system.