How to disable the Shutdown Event Tracker in Windows Server 2008 R2

• Author
• Recent Posts

Timothy Warner

Timothy Warner is a Microsoft Cloud and Datacenter Management Most Valuable Professional (MVP) who is based in Nashville, TN. Check out his Azure and Windows Server video training at Pluralsight, and feel free to reach out to Tim via Twitter.

Latest posts by Timothy Warner (see all)

• Specops Password Auditor v7.2: New features - Thu, Sep 12 2019
• EMCO Ping Monitor Enterprise v7 new features - Tue, Sep 10 2019
• Specops password policy v7.2: New features - Mon, Sep 2 2019

Some IT departments are under governmental and/or industry regulations that require them to account for all system downtime. Other IT departments may be mandated by their service-level agreements (SLAs) to provide documentation for any server restarts or shutdowns.

In Microsoft Windows Server 2008 R2, we have the Shutdown Event Tracker to assist us in not only the previously mentioned scenarios, but also for any shutdown-related troubleshooting we may be called to undertake.

How the Shutdown Event Tracker works ^

In a nutshell, the Shutdown Event Tracker enables Windows systems administrators to provide a reason for any system shutdown or restart event. Let’s clear up some terminology before we proceed any further:

• Planned: This is a shutdown or restart event that was accounted for in advance
• Unplanned: This is a shutdown or restart event that was not accounted for in advance
• Planned + Unexpected: This is a planned shutdown or restart event (for instance, using the power button to shut off a server instead of the Shut Down command) that was unexpected by the operating system
• Unplanned + Unexpected: This is an unplanned shutdown or restart event (for example, a power failure) that was unexpected by the operating system

When you perform an orderly shutdown or restart in Windows Server 2008 R2, the default behavior of the operating system is to display the Shutdown Event Tracker dialog box. This is shown in the next figure:

Shutdown Event Tracker dialog

The systems administrator has an opportunity to (a) specify whether the event is planned or unplanned; (b) choose an event category; and (c) provide a comment.

Shutdown-related events are stored in the System event log under Event ID 1074. You should periodically filter this log to isolate and review shutdown-related events.

Shutdown Event Tracker events in Event Log

If your server crashes or suffers an otherwise unexpected restart, the Shutdown Event Tracker is invoked automatically upon the first administrator logon to the system.

How to Disable the Shutdown Event Tracker

If you want to disable the Shutdown Event Tracker, you can do so either by modifying the local Group Policy of the target system, or by editing the Windows Registry.

To use the Group Policy method, open the Run dialog box from the start menu and type gpedit.msc to open the machine’s local Group Policy.

NOTE: You can manage the Shutdown Event Tracker for multiple systems through Active Directory Group Policy.

In Group Policy Editor, navigate to Computer Configuration\Administrative Templates\System, open the Display Shutdown Event Tracker policy, and set it to Disabled. This process is shown in the following screen capture:

Disable Shutdown Event Tracker through Group Policy

If you prefer to use the Registry to perform this action, then type regedit from the Run dialog or an administrative command prompt and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Reliability. Next, open the ShutdownReasonOn value and set it to 0.

Disable Shutdown Event Tracker through Group Policy

Conclusion ^

By now you should understand the purpose and basic functionality of the Shutdown Event Tracker in Windows Server 2008 R2. You also should know how to disable the feature by using either Group Policy or the Windows Registry.

Are you an IT pro? Apply for membership!

Your question was not answered? Ask in the forum!