Shutdown Event Tracker provides a way for IT professionals to consistently track why users restart or shut down their computers. It does not document why users choose other options, such as Log off or Hibernate. It gathers the reasons users provide for restarts and shutdowns to help create a comprehensive picture of an organization's system environment. Shutdown event tracker is disabled by default on computers running Windows 7.
"Expected" and "unexpected" restarts and shutdowns
When Shutdown Event Tracker is enabled, the “expected” shutdown dialog box appears when you click Start and then Shutdown, when you press ALT+F4 at the desktop, or when you press CTRL+ALT+DELETE and then click Shutdown or Restart. This introduces a step in the shutdown process that prompts you to supply a reason and a comment to explain the action. An expected restart or shutdown provides the operating system time to complete its usual shutdown routine. By contrast, the computer cannot anticipate an "unexpected" restart or shutdown. If Shutdown Event Tracker is enabled, the unexpected shutdown dialog box appears to the first person with membership in the local Users group who logs on to the computer after the restart or shutdown. Like the expected shutdown dialog box, it prompts this user to supply a reason and a comment.
Planned and unplanned restarts and shutdowns
An expected system restart or shutdown can be planned or unplanned. When you have control over the timing of a restart or shutdown, the task is planned. For example, the IT department may reserve a specific time at which to install new applications. By contrast, an unplanned restart or shutdown forces you to immediately perform the task. For example, an unresponsive application might suddenly force you to restart the computer.
Unexpected restarts or shutdowns can also be planned or unplanned. For example, users sometimes choose to shut down their computers by pressing the power button instead of clicking Start and then Shutdown, or pressing CTRL+ALT+DELETE and then clicking Shutdown. In this case, the shutdown is unexpected by the computer and planned by the user. However, if the computer's power cord is accidentally disconnected, the shutdown is both unexpected and unplanned. In each case, the unexpected dialog box appears to the first person with shutdown user rights to log on to the computer after the event.
Local and remote restarts and shutdowns
You can use Shutdown Event Tracker and the Shutdown.exe command-line tool to restart or shut down a local computer and one or more remote computers. Additionally, IT professionals can perform remote bulk annotations of unexpected shutdowns, an alternative to the time-consuming task of logging on to each computer to record a reason for an unexpected shutdown.
Root cause analysis of restarts and shutdowns
Shutdown Event Tracker records the reason for each restart or shutdown through the Event Log service. You can use Event Viewer to open the system log and look for a pattern of events to find the cause of frequent system restarts and shutdowns. For more information about using Event Viewer, see