Shutdown Event Tracker - Windows Server 2003

What is the Shutdown Event Tracker on a Windows Server 2003?

To allow services, programs, and files to close correctly, you should only turn off the Server when the operating system informs you that it is OK to shut down the server.

Server administrators need to monitor when and why servers are restarted, Windows Server 2003 includes the following tools to monitor and control shutdown events:

• Shutdown Event Tracker
• Shutdown.exe

The Shutdown Event Tracker is a new Windows Server 2003 feature. It is a simple GUI application that allows Server administrators to monitor shutdown events on the server. (The tool is enabled on Windows Server 2003 by default.)

The Shutdown Event Tracker collects information on the reasons why the server was shut down, and then logs this information in Event Viewer. Shutdown events can be viewed in Event Viewer.

The Shutdown Event Tracker requires you to provide a reason whenever a server is shut down or restarted. When a server is expectedly shut down, a dialog box or page is displayed, requesting you to specify the reason for the server being shut down. When a server is unexpectedly shut down the next user to log on to the server has to specify the reason for the server shutting down.

Overview of Server Shutdown Types

Server shutdowns can be grouped into two main categories:

1. Expected Shutdowns
2. Unexpected Shutdowns

Expected shutdowns: A shutdown you predict to happen. Expected shutdowns usually occur when one of the following actions are performed:

• Clicking Start, and then the Shutdown command
• Holding down Ctrl + Alt + Del, and then clicking Shutdown

Expected shutdowns can be categorized into:

• Planned shutdowns: These are shutdowns which administrators have some form of control over
• Unplanned shutdowns: These are shutdowns normally started by applications.

Unexpected shutdowns: Server shutdowns which occur without warning. e.g. A power outage.

Useful Links:

Disable Shutdown Event Tracker - Windows Server 2003