The Shutdown Event Tracker

An Overview on Shutdown Events

Computer shutdowns can be sorted into either of the following categories:

• Expected shutdowns: An expected shutdown can be defined as a computer shutdown which you predict to occur. Expected shutdowns usually occur when one of the following actions are performed:

• Clicking Start, and then the Shutdown command
• Holding down Ctrl + Alt + Del, and then clicking Shutdown

Expected shutdown can be categorized into:

• Planned shutdowns: These are shutdowns which administrators have some form of control over
• Unplanned shutdowns: These are shutdowns normally initiated by applications.

Unexpected shutdowns: Unexpected shutdowns result in the system shutting down without warning, or unexpectedly.

To enable services, programs, and files to close correctly, you should only turn off the computer when the operating system informs you that it is OK to shut down the server. This is extremely important because it ensures that all configuration settings and other important information are saved and written to disk.

Since administrators need to monitor when and why servers are restarted, Windows Server 2003 includes the following tools to control shutdown events:

• Shutdown Event Tracker
• Shutdown.exe

The Shutdown Event Tracker, a new Windows Server 2003 feature, is an uncomplicated GUI application that allows administrators to monitor shutdown events on the server. The tool is enabled on Windows Server 2003 by default. The Shutdown Event Tracker collects information on the reasons why the server was shut down, and then logs this information in Event Viewer. The command-line utility equivalent to the Shutdown Event Tracker is Shutdown.exe.

The Shutdown Event Tracker requires you to provide a reason whenever a server is shut down or restarted. When a server is expectedly shut down, a dialog box or page is displayed, requesting you to specify the reason for the server being shut down. When a server is unexpectedly shut down, the following user to log on to the server has to specify the reason for the server shutting down. Shutdown events can be viewed in Event Viewer, and can be useful when you need to improve uptime.

How to configure the Shutdown Event Tracker

• Not Configured
• Enabled
• Disabled

• Always: This option is self explanatory.
• Server Only: When selected, the Shutdown Event Tracker is displayed for only Windows Server 2003 servers.
• Workstation Only: When selected, the Shutdown Event Tracker is displayed for only Windows XP Professional workstations.

1. Click Start, Run, and then enter gpedit.msc. Click OK.
2. The Group Policy Object Editor console opens.
3. In the left pane, expand Computer Configuration, and then Administrative Templates.
4. Click System
5. In the right pane, find and double-click the Display Shutdown Event Tracker.
6. When the Display Shutdown Event Tracker Properties dialog box opens, select one of the following options:
7. If you select the Enabled option, you can choose between the following options to specify when the Shutdown Event Tracker should be displayed:
8. If you want to view help information on the Shutdown Event Tracker application, click the Explain tab.
9. Click OK, and then close the Group Policy Object Editor console.

How the Shutdown Event Tracker works

• Restart
• Shut down
• Log off the current user

1. Enable the Display Shutdown Event Tracker policy so that the Shutdown Event Tracker is displayed.
2. The Shut Down Windows dialog box is displayed when the server is shut down or restarted. The Shut Down Windows dialog box requires you to record information as to why the server was shut down.
3. Using the options in the What do you want the computer to do drop-down list box, you can choose to perform the following tasks:
4. Using the Options: drop-down list box, select the reason that best describes why the server was shut down or restarted.
5. Next, either select or clear the Planned checkbox to indicate whether the shutdown was planned or unplanned.
6. In the Comment box, enter any additional useful information.
7. Click OK to close the Shut Down Windows dialog box

How to induce the Shutdown Event Tracker functionality on a remote computer

1. To bring up the Remote Shutdown Dialog page on a remote computer, use the shutdown.exe command-line utility with /i.
2. Select the appropriate option from the What do you want the computer to do drop-down list box.
3. In the Shutdown Event Tracker group box, select an option which describes why the computer is being shut down, and click the Planned checkbox.
4. Enter a comment in the Comment box.
5. Click OK.

How to use the shutdown.exe command-line utility

The shutdown.exe command-line utility can be used to enter shutdown events using the command-line. The available options for the shutdown.exe command-line utility are listed below:

• /s ServerName: /s shuts the server down, with ServerName detailing the name of the machine which should be shut down.
• /r: Restarts the shutdown computer.
• /t nnn: Specifies, in seconds, the time period for shutdown. The default is 30 seconds, and can be a value between 0 and 600.
• /d [p:xx:yy]: /d describes the reason for the shutdown; p specifies that the shutdown is planned, xx and yy are for the major and minor reason numbers. The shutdown is regarded as being unplanned when p: is missing.
• /p: Used with the /d switch, it indicates that the power of the machine is on.
• /d[p:]xx:yy: xx (major) and yy (minor) indicate the major and minor reason numbers.
• /m computername: Specifies the name of the target computer.
• /a: Cancels the shutdown

How to use the Registry to configure registry entries for the Shutdown Event Tracker

You can use the Registry Editor to configure the Shutdown Event Tracker. Through configuring registry settings, you can enable or disable the Shutdown Event Tracker.

To configure registry settings for the Shutdown Event Tracker,

1. Click Start, Run, enter regedit, and click OK.
2. The Registry Editor console opens.
3. Navigate to HKEY_LOCAL_MACHINE, Software, Microsoft, Windows, CurrentVersion, and then Reliability.
4. Select ShutdownReasonUI. If ShutdownReasonUI does not exist, create a DWORD value, and then name it ShutdownReasonUI.
5. Enter a data value of 1 in the Value data box to enable the Shutdown Event Tracker, or enter a data value of 0 in the Value data to disable the Shutdown Event Tracker.
6. Click OK.
7. Close the Registry Editor console.
8. Restart the computer.

How to add custom reasons for the Shutdown Event Tracker

• P, indicates a planned shutdown.
• C, a comment is required.
• B, a ID is required.
• S, the expected shutdown event dialog box is displayed
• D, the unexpected shutdown event dialog box is displayed

1. Click Start, Run, regedit enter, and click OK.
2. The Registry Editor console opens.
3. Navigate to HKEY_LOCAL_MACHINE, Software, Microsoft, Windows, CurrentVersion, Reliability, and then UserDefined.
4. Create a new string value using the available flags:
5. You can add additional comments using the string registry value. The format for comments is:
6. Click OK and then close the Registry Editor console.
7. Restart the computer.

How to view shutdown events

Shutdown events can be viewed in Event Viewer. Event Viewer is used to monitor events that took place on a computer. Event Viewer stores events that are logged in a system log, application log, and security log. Because the system log conains events that are associated with the operating system, shutdown events are written to the system log.

To open Event Viewer,

1. Select Start, Select Administrative Tools, and then select Event Viewer.
2. Select the event log you want to view.

Event Viewer logs list five event types:

• Information events tell you when a particular activity occurs, such as starting the system.
• Warning events point out problems that could possibly occur.
• Error events indicate an actual error that occurred.
• Success Audit events indicates an event that has been audited for success
• Success Failure events indicates an event that has been audited for failure

To view shutdown events

1. Open Event Viewer
2. Open the System log.
3. Using the Event Source drop-down list, select USER32.
4. To view the System log in a form, filtered to show only shutdown events and USER32 events, click OK.
5. When the events are displayed, you can examine a detailed description of a particular shutdown event by double-clicking the particular event.
6. The Event Properties dialog box is displayed.
7. Click OK to close the dialog box.

How to disable the Shutdown Event Tracker

1. Click Start, Run, and then enter gpedit.msc. Click OK.
2. The Group Policy Object Editor console opens.
3. In the left pane, expand Computer Configuration, and then Administrative Templates.
4. Click System
5. In the right pane, find and double-click the Display Shutdown Event Tracker.
6. When the Display Shutdown Event Tracker Properties dialog box opens, click the Disabled option to disable the Shutdown Event Tracker.
7. Click OK.
8. Close the Group Policy Editor console.