In this article you will learn how the Shutdown Event Tracker works in Windows Server 2008 R2. You will also understand how to disable this functionality if your business needs dictate this action.

Timothy Warner

Timothy Warner is a Microsoft Cloud and Datacenter Management Most Valuable Professional (MVP) who is based in Nashville, TN. Check out his Azure and Windows Server video training at Pluralsight, and feel free to reach out to Tim via Twitter.

Latest posts by Timothy Warner (see all)

Some IT departments are under governmental and/or industry regulations that require them to account for all system downtime. Other IT departments may be mandated by their service-level agreements (SLAs) to provide documentation for any server restarts or shutdowns.

In Microsoft Windows Server 2008 R2, we have the Shutdown Event Tracker to assist us in not only the previously mentioned scenarios, but also for any shutdown-related troubleshooting we may be called to undertake.

How the Shutdown Event Tracker works ^

In a nutshell, the Shutdown Event Tracker enables Windows systems administrators to provide a reason for any system shutdown or restart event. Let’s clear up some terminology before we proceed any further:

  • Planned: This is a shutdown or restart event that was accounted for in advance
  • Unplanned: This is a shutdown or restart event that was not accounted for in advance
  • Planned + Unexpected: This is a planned shutdown or restart event (for instance, using the power button to shut off a server instead of the Shut Down command) that was unexpected by the operating system
  • Unplanned + Unexpected: This is an unplanned shutdown or restart event (for example, a power failure) that was unexpected by the operating system

When you perform an orderly shutdown or restart in Windows Server 2008 R2, the default behavior of the operating system is to display the Shutdown Event Tracker dialog box. This is shown in the next figure:

Disable Shutdown Event Tracker - Shutdown Event Tracker dialog

Shutdown Event Tracker dialog

The systems administrator has an opportunity to (a) specify whether the event is planned or unplanned; (b) choose an event category; and (c) provide a comment.

Shutdown-related events are stored in the System event log under Event ID 1074. You should periodically filter this log to isolate and review shutdown-related events.

Disable Shutdown Event Tracker - Shutdown Event Tracker events in Event Log

Shutdown Event Tracker events in Event Log

If your server crashes or suffers an otherwise unexpected restart, the Shutdown Event Tracker is invoked automatically upon the first administrator logon to the system.

How to Disable the Shutdown Event Tracker

If you want to disable the Shutdown Event Tracker, you can do so either by modifying the local Group Policy of the target system, or by editing the Windows Registry.

To use the Group Policy method, open the Run dialog box from the start menu and type gpedit.msc to open the machine’s local Group Policy.

NOTE: You can manage the Shutdown Event Tracker for multiple systems through Active Directory Group Policy.

In Group Policy Editor, navigate to Computer Configuration\Administrative Templates\System, open the Display Shutdown Event Tracker policy, and set it to Disabled. This process is shown in the following screen capture:

Disable Shutdown Event Tracker through Group Policy

Disable Shutdown Event Tracker through Group Policy

If you prefer to use the Registry to perform this action, then type regedit from the Run dialog or an administrative command prompt and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Reliability. Next, open the ShutdownReasonOn value and set it to 0.

Disable Shutdown Event Tracker through Group Policy

Disable Shutdown Event Tracker through Group Policy

Conclusion ^

By now you should understand the purpose and basic functionality of the Shutdown Event Tracker in Windows Server 2008 R2. You also should know how to disable the feature by using either Group Policy or the Windows Registry.

Are you an IT pro? Apply for membership!

Your question was not answered? Ask in the forum!

0
Share
3 Comments
  1. alfa 8 years ago

    Thank you, gracias, merci, grazie, chukran, chukria, dhanyavan, Doh je, Is askwali

    Many blessings...

    0

  2. Dan 7 years ago

    Thanks for the info, for me not 100% correct for the registry, but did point me in the right direction, or hell windoZe updated after your info. I found the registry setting(s) at:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability (ShutdownReasonUI dword)

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Reliability
    (ShutdownReasonUI dword)

    Anyway thanks much for the info 🙂

    0

  3. Abdul 6 years ago

    Hlw for me i wont to know how i can track the server then on my own device can i be able to switch oof or shutdown de server

    0

Leave a reply

Your email address will not be published. Required fields are marked *

*

© 4sysops 2006 - 2019

CONTACT US

Please ask IT administration questions in the forums. Any other messages are welcome.

Sending

Log in with your credentials

or    

Forgot your details?

Create Account