The Windows Server 2003 and Server 2008 Shutdown Event Tracker is a little like the UAC prompts. It gets on my nerves with a prompt whenever I have to reboot a server. What comment do you usually enter in the Shutdown Event Tracker? My favorite comment is “a” because it is the first character in the alphabet. You can disable this prompt easily with Group Policy or locally with gpedit.msc.
- Pip install Boto3 - Thu, Mar 24 2022
- Install Boto3 (AWS SDK for Python) in Visual Studio Code (VS Code) on Windows - Wed, Feb 23 2022
- Automatically mount an NVMe EBS volume in an EC2 Linux instance using fstab - Mon, Feb 21 2022
Shortly after this feature was first introduced, I always tried to think of a reasonable comment. But I have never needed to look up the reason why a server had to be rebooted. The problem is that Windows servers have to be rebooted so often, that it doesn’t matter anyway. However, I am sure this feature makes sense in some environments.
Before I wrote this post, I didn’t even know where these comments were logged. Well, of course, it is in the Event log. It seems the fastest way to look up shutdown and restart events is to set the event source to USER32 in the filter of the Event Viewer.
To turn off the Shutdown Event Tracker, you have to launch gpedit.msc and navigate to “Computer Configuration – Administrative Templates – System” and then set “Display Shutdown Event Tracker” to “disabled”.
If you would like to know more about the Shutdown Event Tracker, I recommend this article at techFAQ. You won’t believe how much can be said about this little feature.
Subscribe to 4sysops newsletter!
Thanks Mike Azocar (Good to know that there are still Douglas Adams fans out there.)
You might want to be careful about disabling it on a Windows 2008 server. If you have the start menu set to the new look, that shutdown button is sooo much easier to click. I’ve done it before by accident, and was saved from bringing down the server by the Shutdown screen.
Just a thought.
14 years ago
Yeah you are right. I accidentally clicked on it a couple of times already. Perhaps MS changed the shutdown button in Server 2008 so admins won’t dare to disable the Shutdown Event Tracker. 😉