Microsoft 365


Active Directory


Windows Server



Windows Client OS

What's Shutdown Event Tracker on Windows Server 2003?

Daniel Petri


What is the Shutdown Event Tracker on a Windows Server 2003?

Shutdown Event Tracker overview

Shutdown Event Tracker provides a way for IT professionals to consistently track why users restart or shut down their computers. It does not document why users choose other options, such as Log off and Hibernate. It gathers the reasons users give for restarts and shutdowns to help create a comprehensive picture of an organization’s system environment. Shutdown Event Tracker is enabled by default and supported on all Windows Server 2003 family of operating systems. It is disabled by default and unsupported on Windows XP Professional.

“Expected” and “unexpected” startups and shutdowns

When Shutdown Event Tracker is enabled, the “expected” shutdown dialog box appears when users click Start and then Shutdown, or when they press CTRL+ALT+DELETE and then click Shutdown.

This dialog box is different from the standard Windows shutdown dialog box in that it prompts users to supply a reason and a comment to explain the action. An expected startup or shutdown provides the operating system time to complete its usual shutdown routine. By contrast, the computer cannot anticipate an “unexpected” startup or shutdown. If Shutdown Event Tracker is enabled, the unexpected shutdown dialog box appears to the first person with shutdown user rights who logs on to the computer after the startup or shutdown. Like the expected shutdown dialog box, it prompts this user to supply a reason and a comment.

Planned and unplanned startups and shutdowns

From the user’s point of view, an expected system startup or shutdown can be planned or unplanned. When users have control over the timing of a startup or shutdown, the task is planned. For example, the IT department may reserve a specific time at which to install new applications. By contrast, an unplanned restart or shutdown forces users to immediately perform the task. For example, unresponsive applications might suddenly force users to restart their computers.
Unexpected restarts or shutdowns can also be planned or unplanned. For example, users sometimes choose to shut down their computers by pressing the power button instead of clicking Start and then Shutdown, or by pressing CTRL+ALT+DELETE and then clicking Shutdown. In this case, the shutdown is unexpected by the computer and planned by the user. However, if the computer’s power cord is accidentally disconnected, the shutdown is both unexpected and unplanned. In each case, the unexpected dialog box appears to the first person with shutdown user rights to log on to the computer after the event.

To restart or shut down locally and document the reason

Using the Windows interface

  1. Click Start, and then click Shut Down or Restart.
  2. Under What do you want the computer to do, click Restart or Shut down.
  3. If you did not anticipate having to restart or shut down the computer at this time, clear the Planned check box.
  4. Select the appropriate reason from the list.
  5. If a comment is required, the OK button will not function until you type at least one character in the text box.

Using a command line

  1. Open Command Prompt.
  2. Type:

shutdown /s /d 1:1

to initiate an unplanned shut down after a default wait period of 30 seconds, with the major reason, Hardware, and the minor reason, Maintenance.
shutdown /r /t 60 /d p:4:2
to initiate a planned startup after waiting one minute, with the major reason, Application, and the minor reason, Installation.
shutdown /p /d p:1:2
to turn off the power to your computer with no time-out period or warning and to indicate that the action was planned with the major reason Hardware and the minor reason Installation.

Value Description
/s Shuts down the computer
/r Restarts the computer after shutdown
/p Turns off the local computer with no time-out period or warning. You can use /p only with /d. If your computer does not support power off functionality, it will shut down when you use /p, but the power to the computer will remain on
/t nnn Sets the wait period before a restart or shutdown to xxx seconds, causing a warning to display on the local console. You can specify from 0 through 600 seconds. If you omit /t, the wait period defaults to 30 seconds
/d[p:]xx:yy Lists the reason for the system restart, shutdown, or power off. The following rows describe the parameter values
p: Indicates that the restart or shutdown is planned. If you do not use the p: option, Shutdown Event Tracker assumes that the restart or shutdown is unplanned
xx Specifies the major reason number (0-255)
yy Specifies the minor reason number (0-65535)

Local and remote startups and shutdowns

Shutdown Event Tracker and the Shutdown.exe tool enable users to restart or shut down a local computer and one or more remote computers by using either the graphical user interface (GUI) or the Shutdown command.

Additionally, IT professionals can perform remote bulk annotations of unexpected shutdowns, an alternative to the time-consuming task of logging on to each computer to record a reason for an unexpected shutdown.

Root-cause analysis of startups and shutdowns

Shutdown Event Tracker records the reason for each shutdown or startup through the Event Log service. You can use Event Viewer to open the system log and look for a pattern of events to find the cause of frequent system restarts and shutdowns.


Shutdown Event Tracker
System Shutdown Reason Codes

Article saved!

Access saved content from your profile page. View Saved