An Overview on Shutdown Events

Computer shutdowns can be sorted into either of the following categories:

• Expected shutdowns: An expected shutdown can be defined as a computer shutdown which you predict to occur. Expected shutdowns usually occur when one of the following actions are performed:
• Clicking Start, and then the Shutdown command
• Holding down Ctrl + Alt + Del, and then clicking Shutdown

Expected shutdown can be categorized into:

• Planned shutdowns: These are shutdowns which administrators have some form of control over
• Unplanned shutdowns: These are shutdowns normally initiated by applications.
• Unexpected shutdowns: Unexpected shutdowns result in the system shutting down without warning, or unexpectedly.

To enable services, programs, and files to close correctly, you should only turn off the computer when the operating system informs you that it is OK to shut down the server. This is extremely important because it ensures that all configuration settings and other important information are saved and written to disk.

Since administrators need to monitor when and why servers are restarted, Windows Server 2003 includes the following tools to control shutdown events:

• Shutdown Event Tracker
• Shutdown.exe

The Shutdown Event Tracker, a new Windows Server 2003 feature, is an uncomplicated GUI application that allows administrators to monitor shutdown events on the server. The tool is enabled on Windows Server 2003 by default. The Shutdown Event Tracker collects information on the reasons why the server was shut down, and then logs this information in Event Viewer. The command-line utility equivalent to the Shutdown Event Tracker is Shutdown.exe.
The Shutdown Event Tracker requires you to provide a reason whenever a server is shut down or restarted. When a server is expectedly shut down, a dialog box or page is displayed, requesting you to specify the reason for the server being shut down. When a server is unexpectedly shut down, the following user to log on to the server has to specify the reason for the server shutting down. Shutdown events can be viewed in Event Viewer, and can be useful when you need to improve uptime.

How to configure the Shutdown Event Tracker

1. Click Start, Run, and then enter gpedit.msc. Click OK.
2. The Group Policy Object Editor console opens.
3. In the left pane, expand Computer Configuration, and then Administrative Templates.
4. Click System
5. In the right pane, find and double-click the Display Shutdown Event Tracker.
6. When the Display Shutdown Event Tracker Properties dialog box opens, select one of the following options:
• Not Configured
• Enabled
• Disabled
7. If you select the Enabled option, you can choose between the following options to specify when the Shutdown Event Tracker should be displayed:
• Always: This option is self explanatory.
• Server Only: When selected, the Shutdown Event Tracker is displayed for only Windows Server 2003 servers.
• Workstation Only: When selected, the Shutdown Event Tracker is displayed for only Windows XP Professional workstations.
8. If you want to view help information on the Shutdown Event Tracker application, click the Explain tab.
9. Click OK, and then close the Group Policy Object Editor console.

How the Shutdown Event Tracker works

1. Enable the Display Shutdown Event Tracker policy so that the Shutdown Event Tracker is displayed.
2. The Shut Down Windows dialog box is displayed when the server is shut down or restarted. The Shut Down Windows dialog box requires you to record information as to why the server was shut down.
3. Using the options in the What do you want the computer to do drop-down list box, you can choose to perform the following tasks:
• Restart
• Shut down
• Log off the current user
4. Using the Options: drop-down list box, select the reason that best describes why the server was shut down or restarted.
5. Next, either select or clear the Planned checkbox to indicate whether the shutdown was planned or unplanned.
6. In the Comment box, enter any additional useful information.
7. Click OK to close the Shut Down Windows dialog box

How to induce the Shutdown Event Tracker functionality on a remote computer

1. To bring up the Remote Shutdown Dialog page on a remote computer, use the shutdown.exe command-line utility with /i.
2. Select the appropriate option from the What do you want the computer to do drop-down list box.
3. In the Shutdown Event Tracker group box, select an option which describes why the computer is being shut down, and click the Planned checkbox.
4. Enter a comment in the Comment box.
5. Click OK.

How to use the shutdown.exe command-line utility

The shutdown.exe command-line utility can be used to enter shutdown events using the command-line. The available options for the shutdown.exe command-line utility are listed below:

• /s ServerName: /s shuts the server down, with ServerName detailing the name of the machine which should be shut down.
• /r: Restarts the shutdown computer.
• /t nnn: Specifies, in seconds, the time period for shutdown. The default is 30 seconds, and can be a value between 0 and 600.
• /d [p:xx:yy]: /d describes the reason for the shutdown; p specifies that the shutdown is planned, xx and yy are for the major and minor reason numbers. The shutdown is regarded as being unplanned when p: is missing.
• /p: Used with the /d switch, it indicates that the power of the machine is on.
• /d[p:]xx:yy: xx (major) and yy (minor) indicate the major and minor reason numbers.
• /m \\computername: Specifies the name of the target computer.
• /a: Cancels the shutdown

How to use the Registry to configure registry entries for the Shutdown Event Tracker

You can use the Registry Editor to configure the Shutdown Event Tracker. Through configuring registry settings, you can enable or disable the Shutdown Event Tracker.

To configure registry settings for the Shutdown Event Tracker,

1. Click Start, Run, enter regedit, and click OK.
2. The Registry Editor console opens.
3. Navigate to HKEY_LOCAL_MACHINE, Software, Microsoft, Windows, CurrentVersion, and then Reliability.
4. Select ShutdownReasonUI. If ShutdownReasonUI does not exist, create a DWORD value, and then name it ShutdownReasonUI.
5. Enter a data value of 1 in the Value data box to enable the Shutdown Event Tracker, or enter a data value of 0 in the Value data to disable the Shutdown Event Tracker.
6. Click OK.
7. Close the Registry Editor console.
8. Restart the computer.

How to add custom reasons for the Shutdown Event Tracker

1. Click Start, Run, regedit enter, and click OK.
2. The Registry Editor console opens.
3. Navigate to HKEY_LOCAL_MACHINE, Software, Microsoft, Windows, CurrentVersion, Reliability, and then UserDefined.
4. Create a new string value using the available flags:
• P, indicates a planned shutdown.
• C, a comment is required.
• B, a ID is required.
• S, the expected shutdown event dialog box is displayed
• D, the unexpected shutdown event dialog box is displayed
5. You can add additional comments using the string registry value. The format for comments is: