Disable Shutdown Event Tracker in Windows 2003

How can I disable the Shutdown Event Tracker on a Windows Server 2003 machine?

Shutdown Event Tracker provides a way for IT professionals to consistently track why users restart or shut down their computers. It does not document why users choose other options, such as Log off and Hibernate. It gathers the reasons users give for restarts and shutdowns to help create a comprehensive picture of an organization’s system environment.
You can later view the Shutdown Event Tracker log by searching for the User32 1076 event in the Event Viewer console under the System Log.
This event refers to the failure indicated by the previous Event Log 6008 event. The User32 1076 event is written when the first user with shutdown privileges logs on to the computer after an unexpected restart or shutdown and supplies a reason for the occurrence. An unexpected restart or shutdown is one that the system cannot anticipate, such as when the user pushes the computer’s reset button or unplugs the power cord.
Shutdown Event Tracker is enabled by default and supported on all Windows Server 2003 family of operating systems.
To disable Shutdown Event Tracker perform the following:

1. Open Group Policy, then load the group policy you want to apply the change to.

Note: On a computer that is not a part of a domain you can set this feature locally by running GPEDIT.MSC from the Run command.


For example, if you want the setting to affect the entire domain, edit the Default Domain GPO, or another GPO on the domain level.

2. Expand Computer Configuration > Administrative Templates > System.
3. Double-click Display Shutdown Event Tracker.
4. Select Disabled.

5. Click OK to close all dialog boxes.
6. If you want the change to take place right now, refresh the GPO by running the following command in a Command Prompt window or from the Run command:

​gpupdate /force

Links

Shutdown Event Tracker
System Shutdown Reason Codes