The Windows Server 2003 and Server 2008 Shutdown Event Tracker is a little like the UAC prompts. It gets on my nerves with a prompt whenever I have to reboot a server. What comment do you usually enter in the Shutdown Event Tracker? My favorite comment is “a” because it is the first character in the alphabet. You can disable this prompt easily with Group Policy or locally with gpedit.msc.
- OpenVPN IPv6 and IPv4 configuration - Mon, Mar 1 2021
- 4sysops author and member competition 2020 - Fri, Jan 1 2021
- Assign an IPv6 address to an EC2 instance (dual stack) - Tue, Dec 15 2020
Shortly after this feature was first introduced, I always tried to think of a reasonable comment. But I have never needed to look up the reason why a server had to be rebooted. The problem is that Windows servers have to be rebooted so often, that it doesn’t matter anyway. However, I am sure this feature makes sense in some environments.
Before I wrote this post, I didn’t even know where these comments were logged. Well, of course, it is in the Event log. It seems the fastest way to look up shutdown and restart events is to set the event source to USER32 in the filter of the Event Viewer.
To turn off the Shutdown Event Tracker, you have to launch gpedit.msc and navigate to “Computer Configuration - Administrative Templates - System” and then set “Display Shutdown Event Tracker” to “disabled”.
If you would like to know more about the Shutdown Event Tracker, I recommend this article at techFAQ. You won’t believe how much can be said about this little feature.
Subscribe to 4sysops newsletter!
Thanks Mike Azocar (Good to know that there are still Douglas Adams fans out there.)
You might want to be careful about disabling it on a Windows 2008 server. If you have the start menu set to the new look, that shutdown button is sooo much easier to click. I've done it before by accident, and was saved from bringing down the server by the Shutdown screen.
Just a thought.
13 years ago
Yeah you are right. I accidentally clicked on it a couple of times already. Perhaps MS changed the shutdown button in Server 2008 so admins won't dare to disable the Shutdown Event Tracker. 😉