Microsoft KB Archive/293814

= Description of the Shutdown Event Tracker =

Article ID: 293814

Article Last Modified on 1/31/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, 64-Bit Datacenter Edition
 * Microsoft Windows Server 2003, Enterprise x64 Edition
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Web Edition
 * Microsoft Windows XP Professional for Itanium-based systems
 * Microsoft Windows XP Professional for Itanium-based systems
 * Microsoft Windows XP Professional
 * Microsoft Windows XP Tablet PC Edition
 * Microsoft Windows XP Media Center Edition 2002

-



This article was previously published under Q293814



IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



SUMMARY
Shutdown Event Tracker is a Microsoft Windows Server 2003 and Microsoft Windows XP feature that you can use to consistently track the reason for system shutdowns. You can then use this information to analyze shutdowns and to develop a more comprehensive understanding of your system environment. Shutdown Event Tracker logs events that are similar to the following in the system event log: Event Type: Information

Event Source: USER32

Event Category: None

Event ID: 1074

Date: 6/26/2003

Time: 1:53:20 PM

User: \

Computer:

Description: The process Explorer.EXE has initiated the shutdown of computer  on behalf of user  \  for the following reason:

Hardware: Maintenance (Planned)

Reason Code: 0x84010001

Shutdown Type: shutdown

Comment:

For more information, see Help and Support Center at http://support.microsoft.com. Data: 0000: 01 00 01 84 ...



Windows Server 2003 and Windows XP 64-Bit Edition Version 2003
By default, Shutdown Event Tracker is enabled for all Windows Server 2003 operating systems and for Windows XP 64-Bit Edition Version 2003.

To disable Shutdown Event Tracker on all Windows Server 2003 operating systems and in Windows XP 64-Bit Edition Version 2003, disable the Display Shutdown Event Tracker policy by using Group Policy. To do this by using Local Group Policy, follow these steps:
 * 1) Click Start, and then click Run.
 * 2) Type gpedit.msc, and then click OK.
 * 3) Expand Computer Configuration, expand Administrative Templates, and then expand System.
 * 4) Double-click Display Shutdown Event Tracker.
 * 5) Click Disabled, and then click OK.

Windows XP Professional
By default, Shutdown Event Tracker is disabled in Windows XP Professional.

To enable Shutdown Event Tracker in Windows XP Professional, in Windows XP Tablet PC Edition, and in Windows XP Media Center Edition, enable the Display Shutdown Event Tracker policy by using Group Policy. To do this by using Local Group Policy, follow these steps:
 * 1) Click Start, and then click Run.
 * 2) Type gpedit.msc, and then click OK.
 * 3) Expand Computer Configuration, expand Administrative Templates, and then expand System.
 * 4) Double-click Display Shutdown Event Tracker.
 * 5) Click Enabled.
 * 6) In the Shutdown Event Tracker should be displayed box, click Always, and then click OK.

Shutdown Event Tracker is not a functional component in Windows XP Home Edition. Therefore, you cannot use Shutdown Event Tracker in Windows XP Home Edition.

Note Microsoft recommends that you do not enable the Shutdown Event Tracker in Windows XP Professional, Windows XP Tablet PC, or Windows XP Media Center Editions. Microsoft does not support the use of this component in these Windows XP environments.

Custom Options for Identifying a Shutdown Cause
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

Windows provides a list of eight generic reasons why your computer was shut down. You can modify this list to include your own custom reasons. To add your own reasons, follow these steps:  Start Registry Editor. Locate and then click the following registry key:

 On the Edit menu, click New, and then click Multi-String Value. This creates the new key and gives it the temporary name &quot;New Value.&quot; Type the name of the registry key in the following format, and then press ENTER:

; ;

The  section of the value name can contain one or more of the following values:  P (Indicates that the reason is planned. If this value is omitted, the default is unplanned.) C or B (Indicates that a comment is required.)</li> S (Indicates that the reason should be displayed in the user-initiated shutdown dialog box.)</li> D (Indicates that the reason should be displayed in the sudden shutdown dialog box.)</li></ul>

For example, if you want a reason to be displayed in the sudden shutdown dialog box, the shutdown is unplanned, and the shutdown corresponds to a major reason 2 and to a minor reason 2, type the following value name:

D;2;2

</li> Double-click the new key, and then define the value data in the following format:

Title

Description

Each value is made up of two strings on separate lines; the first string is the title (this is displayed in the list) and the second string is the description (this is the text that is displayed following the selected reason).

For example, if you want to create a custom reason for a natural disaster, you can define the value data as follows:

Natural Disaster (unplanned)

A flood, an earthquake, a tornado, or another unplanned natural event requires that the computer be shut down. Specify the natural event in the comment area.

</li> Quit Registry Editor.</li></ol>