Windows XP provides a mechanism for recording the reason for shutting down.
To enable the recording of the shutdown reason:
1. Use the Registry Editor to navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability
2. Edit or create a ShutdownReasonUI Value Name, a REG_DWORD data type, and set the data value to 1.
When you shutdown, the Shut Down Windows dialog box is expanded to include a Shutdown Event Tracker section, which contains a check box for Planned, a Options drop down box to select the reason, and a Comment text box to record any additional data.
The Options drop down allows you to select:
Planned is checked
Other (Planned)
Hardware: Maintenance (Planned)
Hardware: Installation (Planned)
Operating System: Upgrade (Planned)
Operating System: Reconfiguration (Planned)
Application: Maintenance (Planned)
Planned is NOT checked
Other (Unplanned)
Hardware: Maintenance (Unplanned)
Hardware: Installation (Unplanned)
Operating System: Upgrade (Unplanned)
Operating System: Reconfiguration (Unplanned)
Application: Maintenance (Unplanned)
Application: Unresponsive
Application: Unstable
These selections are recorded in the System event log as Event ID 1074.
Whether or not the ShutdownReasonUI data value is set to 1, the Shutdown command can optionally record the reason for shutting down.
When you open a CMD prompt and type shutdown /?, you receive:
Usage: shutdown \[-i | -l | -s | -r | -a\] \[-f\] \[-m \\computername\] \[-t xx\] \[-c "comment"\] \[-d up:xx:yy\]
No args Display this message (same as -?)
-i Display GUI interface, must be the first option
-l Log off (cannot be used with -m option)
-s Shutdown the computer
-r Shutdown and restart the computer
-a Abort a system shutdown
-m \\computername Remote computer to shutdown/restart/abort
-t xx Set timeout for shutdown to xx seconds
-c "comment" Shutdown comment (maximum of 127 characters)
-f Forces running applications to close without warning
-d \[u\]\[p\]:xx:yy The reason code for the shutdown
u is the user code
p is a planned shutdown code
xx is the major reason code (positive integer less than 256)
yy is the minor reason code (positive integer less than 65536)
NOTE: The u parameter causes a second Event ID 1074 for the User Name that was logged on at shutdown.
NOTE: See How can I create user defined reasons for the Shutdown Event Tracker?
