Configuring Shutdown Event Tracker

Shutdown Event Tracker is a new feature provided with Windows Server 2003 that allows you to track the reason why users restart or shut down their computers. This feature is enabled by default on all Windows Server 2003 operating systems - any time you need to shut down or restart Windows Server 2003, the Shut Down Windows dialog prompts you to specify the reason for shutdown or restart. Note that Shutdown Event Tracker doesn't allow you to complete the action until you have specified a reason (Fig. 4.14).

Figure 4.14: The Shutdown Event Tracker prompts you to specify the reason for shutdown or restart

Note 

The Shutdown Event Tracker documents only startup and shutdown events and doesn't gather information related to the reason users might choose other options, such as Log off or Hibernate.

When Shutdown Event Tracker feature is enabled, Windows Server 2003 provides you with the options for entering descriptive comments, for selecting from a list of predefined shutdown reasons, or for adding custom shutdown reasons, including:

• Other (Unplanned)

• Other (Planned)

• Hardware: Maintenance (Unplanned)

• Hardware: Maintenance (Planned)

• Hardware: Installation (Unplanned)

• Hardware: Installation (Planned)

• Operating System: Upgrade (Unplanned)

• Operating System: Upgrade (Planned)

• Operating System: Configuration (Unplanned)

• Operating System: Configuration (Planned)

• Application: Maintenance (Unplanned)

• Application: Maintenance (Planned)

• Application: Hung (Unplanned)

• Application: Unstable (Unplanned)

The restart and shutdown reasons gathered by Shutdown Event Tracker are recorded in the System Event Log in order to help the administrator to create a comprehensive picture of the organization's system environment (Fig. 4.15). To view Shutdown Event Tracker information:

Figure 4.15: The restart and shutdown reasons collected by Shutdown Event Tracker are recorded in the System event log

1. Start Event Viewer from the Start menu by clicking Run and typing eventvwr.msc in the Open field.

2. Under Event Viewer (local), click System.

3. Search for an entry that contains USER32 in the Source column and 1075, 1075 or 1076 in the Event column by clicking Find on the View menu.

4. Double-click the entry and view the information found under Description.

As was mentioned earlier, Shutdown Event Tracker is enabled by default on all Windows Server 2003 operating systems. However, if this feature seems boring to you (for example, you simply don't like to have to supply a reason any time you need to shutdown or reboot your server), you can disable this feature using Group Policy. To do so, proceed as follows:

1. To disable the feature on your local computer, start the Local Computer Policy MMC snap-in. To do so, select Run from the Start menu and enter mmc in the Open field. Select Add/Remove Snap-in from the File menu. Then click Add and select the Group Policy Object Editor from the list of available standalone snap-ins.

2. Expand the console tree as shown in Fig. 4.16 (Local Computer Policy | Computer Configuration | Administrative Templates | System) and double-click on the Display Shutdown Event Tracker policy. On the Setting tab, select the Disabled option, click Apply, and click OK.

Figure 4.16: Disabling the Shutdown Event Tracker on Windows Server 2003

Note 

To configure Shutdown Event Tracker on a domain or Organizational Unit, use Active Directory Users and Computers, expand the console tree, select the required domain or organizational unit, right-click it and select the Properties command. After that, go to the Group Policy tab (Fig. 4.17) and click Edit.

Figure 4.17: Configuring Shutdown Event Tracker on a domain or Organizational Unit

Using Group Policy is the best method for configuring Shutdown Event Tracker on servers running any OS of the Windows Server 2003 family. However, this situation is different for Windows XP clients. As was already mentioned, Shutdown Event Tracker is disabled by default on Windows XP Professional. Sometimes, however, you might want to enable this feature on a standalone Windows XP workstation. The best way of achieving this is direct registry editing.

1. Start Regedit.exe and find the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability.

2. Edit or create the REG_DWORD value named ShutdownReasonUI. To enable the tracking feature for shutdown events, assign a value of 1 to this registry entry. Click OK and close the Registry Editor.

After you have done this, Windows XP Professional will implement the Shutdown Event Tracker function similar to the one found on Windows Server 2003.