Shutdown Event Tracker overview

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Shutdown Event Tracker overview

Shutdown Event Tracker provides a way for IT professionals to consistently track why users restart or shut down their computers. It does not document why users choose other options, such as Log off and Hibernate. It gathers the reasons users give for restarts and shutdowns to help create a comprehensive picture of an organization's system environment. Shutdown Event Tracker is enabled by default and supported on all Microsoft® Windows Server 2003 family of operating systems. It is disabled by default and unsupported on Microsoft® Windows® XP Professional.

"Expected" and "unexpected" startups and shutdowns

When Shutdown Event Tracker is enabled, the “expected” shutdown dialog box appears when users click Start and then Shutdown, or when they press CTRL+ALT+DELETE and then click Shutdown. This dialog box is different from the standard Windows shutdown dialog box in that it prompts users to supply a reason and a comment to explain the action. An expected startup or shutdown provides the operating system time to complete its usual shutdown routine. By contrast, the computer cannot anticipate an "unexpected" startup or shutdown. If Shutdown Event Tracker is enabled, the unexpected shutdown dialog box appears to the first person with shutdown user rights who logs on to the computer after the startup or shutdown. Like the expected shutdown dialog box, it prompts this user to supply a reason and a comment.

Planned and unplanned startups and shutdowns

From the user's point of view, an expected system startup or shutdown can be planned or unplanned. When users have control over the timing of a startup or shutdown, the task is planned. For example, the IT department may reserve a specific time at which to install new applications. By contrast, an unplanned restart or shutdown forces users to immediately perform the task. For example, unresponsive applications might suddenly force users to restart their computers.

Unexpected restarts or shutdowns can also be planned or unplanned. For example, users sometimes choose to shut down their computers by pressing the power button instead of clicking Start and then Shutdown, or by pressing CTRL+ALT+DELETE and then clicking Shutdown. In this case, the shutdown is unexpected by the computer and planned by the user. However, if the computer's power cord is accidentally disconnected, the shutdown is both unexpected and unplanned. In each case, the unexpected dialog box appears to the first person with shutdown user rights to log on to the computer after the event.

For step-by-step guidance and specific examples, see Restart or shut down locally and document the reason and Restart or shut down remotely and document the reason.

Local and remote startups and shutdowns

Shutdown Event Tracker and the Shutdown.exe tool enable users to restart or shut down a local computer and one or more remote computers by using either the graphical user interface (GUI) or the Shutdown command. Additionally, IT professionals can perform remote bulk annotations of unexpected shutdowns, an alternative to the time-consuming task of logging on to each computer to record a reason for an unexpected shutdown.

Root-cause analysis of startups and shutdowns

Shutdown Event Tracker records the reason for each shutdown or startup through the Event Log service. You can use Event Viewer to open the system log and look for a pattern of events to find the cause of frequent system restarts and shutdowns. For more information, see Event Viewer.

The System State Data feature gathers information for root-cause analysis of unplanned shutdowns. System state data is recorded in a log file when a user who has shutdown user rights specifies an unplanned reason for shutting down a computer. Regardless of who gathers the data, only users with administrative credentials can view it or, optionally, send it to Microsoft. The first person with administrative credentials to log on to the computer after the unplanned shutdown encounters a Windows error reporting dialog box with a link to the system state data file. This file is stored in the %windir%\system32\LogFiles\Shutdown\ directory.

The System State Data feature is available on all Windows Server 2003 family of operating systems. It is not available on Windows XP Professional. For step-by-step guidance, see Configure the System State Data feature on your local computer and Configure the System State Data feature on a domain or organizational unit.