In this article you will learn how the Shutdown Event Tracker works in Windows Server 2008 R2. You will also understand how to disable this functionality if your business needs dictate this action.

Some IT departments are under governmental and/or industry regulations that require them to account for all system downtime. Other IT departments may be mandated by their service-level agreements (SLAs) to provide documentation for any server restarts or shutdowns.

In Microsoft Windows Server 2008 R2, we have the Shutdown Event Tracker to assist us in not only the previously mentioned scenarios, but also for any shutdown-related troubleshooting we may be called to undertake.

How the Shutdown Event Tracker works ^

In a nutshell, the Shutdown Event Tracker enables Windows systems administrators to provide a reason for any system shutdown or restart event. Let’s clear up some terminology before we proceed any further:

  • Planned: This is a shutdown or restart event that was accounted for in advance
  • Unplanned: This is a shutdown or restart event that was not accounted for in advance
  • Planned + Unexpected: This is a planned shutdown or restart event (for instance, using the power button to shut off a server instead of the Shut Down command) that was unexpected by the operating system
  • Unplanned + Unexpected: This is an unplanned shutdown or restart event (for example, a power failure) that was unexpected by the operating system

When you perform an orderly shutdown or restart in Windows Server 2008 R2, the default behavior of the operating system is to display the Shutdown Event Tracker dialog box. This is shown in the next figure:

Disable Shutdown Event Tracker - Shutdown Event Tracker dialog

Shutdown Event Tracker dialog

The systems administrator has an opportunity to (a) specify whether the event is planned or unplanned; (b) choose an event category; and (c) provide a comment.

Shutdown-related events are stored in the System event log under Event ID 1074. You should periodically filter this log to isolate and review shutdown-related events.

Disable Shutdown Event Tracker - Shutdown Event Tracker events in Event Log

Shutdown Event Tracker events in Event Log

If your server crashes or suffers an otherwise unexpected restart, the Shutdown Event Tracker is invoked automatically upon the first administrator logon to the system.

How to Disable the Shutdown Event Tracker

If you want to disable the Shutdown Event Tracker, you can do so either by modifying the local Group Policy of the target system, or by editing the Windows Registry.

To use the Group Policy method, open the Run dialog box from the start menu and type gpedit.msc to open the machine’s local Group Policy.

NOTE: You can manage the Shutdown Event Tracker for multiple systems through Active Directory Group Policy.

In Group Policy Editor, navigate to Computer Configuration\Administrative Templates\System, open the Display Shutdown Event Tracker policy, and set it to Disabled. This process is shown in the following screen capture:

Disable Shutdown Event Tracker through Group Policy

Disable Shutdown Event Tracker through Group Policy

If you prefer to use the Registry to perform this action, then type regedit from the Run dialog or an administrative command prompt and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Reliability. Next, open the ShutdownReasonOn value and set it to 0.

Disable Shutdown Event Tracker through Group Policy

Disable Shutdown Event Tracker through Group Policy

Conclusion ^

By now you should understand the purpose and basic functionality of the Shutdown Event Tracker in Windows Server 2008 R2. You also should know how to disable the feature by using either Group Policy or the Windows Registry.

  1. alfa 10 years ago

    Thank you, gracias, merci, grazie, chukran, chukria, dhanyavan, Doh je, Is askwali

    Many blessings…

  2. Dan 10 years ago

    Thanks for the info, for me not 100% correct for the registry, but did point me in the right direction, or hell windoZe updated after your info. I found the registry setting(s) at:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability (ShutdownReasonUI dword)

    (ShutdownReasonUI dword)

    Anyway thanks much for the info 🙂

  3. Abdul 8 years ago

    Hlw for me i wont to know how i can track the server then on my own device can i be able to switch oof or shutdown de server

Leave a reply

Your email address will not be published.


© 4sysops 2006 - 2022


Please ask IT administration questions in the forums. Any other messages are welcome.


Log in with your credentials


Forgot your details?

Create Account