Coming Soon: GET:IT Endpoint Management 1-Day Conference on September 28th at 9:30 AM ET Coming Soon: GET:IT Endpoint Management 1-Day Conference on September 28th at 9:30 AM ET
Windows Client OS

Disable Shutdown Event Tracker in Windows 2003

How can I disable the Shutdown Event Tracker on a Windows Server 2003 machine?

Shutdown Event Tracker provides a way for IT professionals to consistently track why users restart or shut down their computers. It does not document why users choose other options, such as Log off and Hibernate. It gathers the reasons users give for restarts and shutdowns to help create a comprehensive picture of an organization’s system environment.

You can later view the Shutdown Event Tracker log by searching for the User32 1076 event in the Event Viewer console under the System Log.

Sponsored Content

Say Goodbye to Traditional PC Lifecycle Management

Traditional IT tools, including Microsoft SCCM, Ghost Solution Suite, and KACE, often require considerable custom configurations by T3 technicians (an expensive and often elusive IT resource) to enable management of a hybrid onsite + remote workforce. In many cases, even with the best resources, organizations are finding that these on-premise tools simply cannot support remote endpoints consistently and reliably due to infrastructure limitations.

This event refers to the failure indicated by the previous Event Log 6008 event. The User32 1076 event is written when the first user with shutdown privileges logs on to the computer after an unexpected restart or shutdown and supplies a reason for the occurrence. An unexpected restart or shutdown is one that the system cannot anticipate, such as when the user pushes the computer’s reset button or unplugs the power cord.

Shutdown Event Tracker is enabled by default and supported on all Windows Server 2003 family of operating systems.

To disable Shutdown Event Tracker perform the following:

  1. Open Group Policy, then load the group policy you want to apply the change to.

Note: On a computer that is not a part of a domain you can set this feature locally by running GPEDIT.MSC from the Run command.

For example, if you want the setting to affect the entire domain, edit the Default Domain GPO, or another GPO on the domain level.

  1. Expand Computer Configuration > Administrative Templates > System.
  2. Double-click Display Shutdown Event Tracker.
  3. Select Disabled.

  1. Click OK to close all dialog boxes.
  2. If you want the change to take place right now, refresh the GPO by running the following command in a Command Prompt window or from the Run command:

​gpupdate /force

Links

Shutdown Event Tracker

System Shutdown Reason Codes

Related Topics:

BECOME A PETRI MEMBER:

Don't have a login but want to join the conversation? Sign up for a Petri Account

Register
Comments (0)

Leave a Reply

Live Webinar: Active Directory Security: What Needs Immediate Priority!Live on Tuesday, October 12th at 1 PM ET

Attacks on Active Directory are at an all-time high. Companies that are not taking heed are being punished, both monetarily and with loss of production.

In this webinar, you will learn:

  • How to prioritize vulnerability management
  • What attackers are leveraging to breach organizations
  • Where Active Directory security needs immediate attention
  • Overall strategy to secure your environment and keep it secured

Sponsored by: