Shutdown Event Tracker

You can use Shutdown Event Tracker to record the reason for shutting down or restarting Windows.

  • For tips about using the Shutdown Event Tracker, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Best practices

  • Establish guidelines for usage of specific reason options

    You should apply the reasons provided in the Shutdown Event Tracker dialog box consistently to get the most benefit from using those reasons. If you are a system administrator, it is recommended that you establish and communicate specific guidelines for using each reason. You should also provide guidance on what additional information should be supplied in the Comment box.

    You might want to establish guidelines such as those provided in the following example:

    • If during routine maintenance, new hardware and software are added to a computer, use the reason Hardware:Maintenance (Planned). Always supply the name of the new software in the Shutdown Event Tracker Comment box.

  • Establish standards for information to include in the Shutdown Event Tracker Comment box

    If you are a system administrator, you should establish and communicate specific guidelines for entering information into the Shutdown Event Tracker Comment box. You should include guidelines that specify when users should provide information, what information they should provide, and what form that information should take.

  • Regularly review Shutdown Event Tracker data

    In order to identify commonalties and trends in computer shutdowns, review the shutdown data in the event log on a regular basis. Although the shutdown reasons alone might not be enough for you to identify underlying system problems, the reasons can provide insight into potential configuration changes that should be made or other problems that should be addressed. For more information, see To review Shutdown Event Tracker data.

For general information about Shutdown Event Tracker, see Shutdown Event Tracker overview. For information on using Shutdown Event Tracker for user-initiated shutdowns, see Using Shutdown Event Tracker for user-initiated shutdowns.


How to…

Microsoft Windows graphic

How to...

  • Shutdown and document the reason
  • Enable Shutdown Event Tracker
  • Disable Shutdown Event Tracker
  • Add your own shutdown reasons
  • Turn off predefined reasons
  • Review Shutdown Event Tracker data


Shutdown and document the reason

Microsoft Windows graphic

To shutdown and document the reason

Using the Windows interface

  1. Click Start, and then click Turn off computer.
  2. In the Options list, select a reason.
  3. In Comment box, type a comment, and then click OK.

Important

  • Do not turn off your computer until a message appears telling you that it is safe to do so. Windows stores important data in memory while the system is running and must write the data to the hard disk before you turn off the computer. After the data is saved, Windows notifies you that it is safe to turn off the computer.

Note

    You can provide detailed comments about the reason for the shutdown in the Comment box. You are required to fill this text box when you choose Other in the Option box.

  • You can also shut down your computer by pressing CTRL+ALT+DELETE, and then clicking Shut Down.

Using a command line

  1. Open Command Prompt.
  2. Type:

    shutdown [-l | -s |-r | -a] [-f] [-m \\ComputerName] [-t xx] [-c "message"] [-d [u][p]:xx:yy]

    3. Value | Description
    -l | Logs off the current user; this is also the default. -m ComputerName takes precedence.
    -s | Shuts down the local computer.
    -r | Reboots after shutdown.
    -a | Quits shutdown. Ignores other parameters, except -l and ComputerName. You can use -a only during the time-out period.
    -f | Forces running applications to close.
    -m [\\ComputerName] | Specifies the computer that you want to shut down.
    -t xx | Sets the timer for system shutdown in xx seconds. The default is 20 seconds.
    -c "message" | Specifies a message to be displayed in the Message area of the System Shutdown window. You can use a maximum of 127 characters. You must enclose the message in quotation marks.
    -d [u][p]:xx:yy Lists the reason code for the shutdown. The following table lists the different values.
    Value | Description
u | Indicates a user code.
p | Indicates a planned shutdown code.
xx | Specifies the major reason code (0-255).
yy | Specifies the minor reason code (0-65536).

Example

To shut down \\MyServer in 60 seconds, force running applications to close, restart the computer after shutdown, indicate a user code, indicate that the shutdown is planned, log major reason code 125, and log minor reason code 1, type:

shutdown -r -f -m \\MyServer -t 60 -d up:125:1

Notes

  • XOX
  • If you indicate a major and minor reason code, you must first define these reason codes on each computer for which you plan to use the particular reason. If the reason codes are not defined on the target computer, Event Viewer cannot log the correct reason text.

Related Topics


Enable Shutdown Event Tracker

Microsoft Windows graphic

To enable Shutdown Event Tracker

  1. Open Registry Editor.

    2. Caution

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. You can also use the Last Known Good Configuration startup option if you encounter problems after manual changes have been applied.
  2. In Registry Editor, navigate to the following registry key:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Reliability

  3. Click the following entry:

    ShutdownReasonUI:REG_DWORD:

  4. Assign a value of 1, and close Registry Editor.

Notes

  • To open Registry Editor, click Start, click Run, type regedit, and then click OK.

Related Topics


Disable Shutdown Event Tracker

Microsoft Windows graphic

To disable Shutdown Event Tracker

  1. Open Registry Editor.

    2. Caution

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. You can also use the Last Known Good Configuration startup option if you encounter problems after manual changes have been applied.
  2. In Registry Editor, navigate to the following registry key:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Reliability

  3. Click the following entry:

    ShutdownReasonUI:REG_DWORD:

  4. Assign a value of 0, and close Registry Editor.

Notes

  • To open Registry Editor, click Start, click Run, type regedit, and then click OK.

Related Topics


Add your own shutdown reasons

Microsoft Windows graphic

To add your own shutdown reasons

  1. Open Registry Editor.

    2. Caution

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. You can also use the Last Known Good Configuration start-up option if you encounter problems after manual changes have been applied.
  2. In Registry Editor, navigate to the following registry key:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Reliability\UserDefined

  3. On the Edit menu, click New and select Multi-String Value. The new key will be created and given the temporary title New Value.
  4. Replace the temporary title New Value by typing the name of the registry key using the following format:

    UI Control Flags;Major Reason Number;Minor Reason Number

    The UI Control Flags can contain one or more of the following values:

    Value | Description
    P | Indicates the reason is planned. If omitted, it defaults to unplanned.
    C or B | A comment is required.
    S | Indicates that the reason should be displayed in the user-initiated shutdown dialog box.
    D | Indicates that the reason should be displayed in the sudden shutdown dialog box.

    Example:

    For a planned user-initiated shutdown that requires a comment with major reason 2 and minor reason 2, type the following for the name:

    PCS;2;2

  5. After you type the name of the new registry key, press ENTER.
  6. Double-click the new key and define the Value data using the following format:

    Title

    Description

    Each value consists of two strings on separate lines. The first string is the title, which is displayed in the drop-down box. The second string is the description, which is displayed as text beneath the selected reason.

    Example:

    Natural Disaster (unplanned)

    A flood, earthquake, tornado or other other unplanned natural event requires the computer be shutdown. Please specify the natural event in the Comment box.

  7. Close Registry Editor.

Notes

  • To open Registry Editor, click Start, click Run, type regedit, and then click OK.
  • Both S and D can be specified, but at least one of them must be present for the parameters to be valid.
  • If the UIControl flags section contains any characters other than the ones listed previously, or if it exceeds five characters, the message is not valid and will not be displayed. The characters can appear in any order.
  • The MajorReasonNumber is a number from 0 through 255. If it is blank, is out of the valid range, or is not an integer, the message is not valid and will not be displayed.
  • The MinorReasonNumber is an number from 0 through 65536. If it is blank, is out of the valid range, or is not an integer, the message is not valid and will not be displayed.
  • The custom reasons are sorted in the user interface by two keys in the following order: MajorReasonNumber, MinorReasonNumber.
  • The maximum length for the title is 64 character. The maximum length for the description is 696 characters.
  • If you set the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\ShutdownIgnorePredefinedReasons to any non-zero value, and you have correctly defined at least one custom reason, the standard Windows reasons will not be displayed in the Shut Down Windows dialog box. For more information about turning off the predefined reasons, see Related Topics.

Related Topics


Turn off predefined reasons

Microsoft Windows Graphic

To turn off predefined reasons

  1. Open Registry Editor.

    2. Caution

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. You can also use the Last Known Good Configuration start-up option if you encounter problems after you have manually applied the changes.
  2. In Registry Editor, navigate to the following registry key:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Reliability

  3. Click Edit, point to New, and then click DWORD Value.
  4. In the text box that appears, type ShutdownIgnorePredefinedReasons, and then press Enter.
  5. Double-click the ShutdownIgnorePredefinedReasons registry key you just created, and then change Value Data to 1.
  6. Click OK, and then close Registry Editor.

Notes

  • To open Registry Editor, click Start, click Run, type regedit, and then click OK.
  • You must have at least one correctly defined custom reason before you can turn off the predefined reasons. For information on how to add your own reason, see Related Topics.

Related Topics


Review Shutdown Event Tracker data

Microsoft Windows graphic

To review Shutdown Event Tracker data

  1. Open Event Viewer.
  2. Click System Log, scroll to the Event column, and find entries with the number 1075.

Note

  • XOX

Related Topics


Concepts

This section covers:
  • Shutdown Event Tracker overview
  • Understanding Shutdown Event Tracker
  • Using Shutdown Event Tracker
  • Managing Shutdown Event Tracker from the command line


Shutdown Event Tracker overview

Shutdown Event Tracker provides a simple and standard mechanism you can use to consistently document the reasons for shutting down or restarting your computer. You can then use this information to analyze the root causes of shutdowns and develop a more complete understanding of your system environment.

To record a shutdown or restart reason, you enter it into the Shut Down Windows dialog box. The Shut Down Windows dialog box is displayed as part of the shutdown sequence, or when restarting a system after a sudden shutdown. Windows provides predefined reason options. You can also add custom reason options. The information you provide here is recorded in the system log in Event Viewer. For more information on Event Viewer, see Event Viewer overview.

By default, Shutdown Event Tracker is disabled for Windows XP. For more information about enabling Shutdown Event Tracker, see Enable Shutdown Event Tracker. For more information on disabling Shutdown Event Tracker, see Disable Shutdown Event Tracker.


Understanding Shutdown Event Tracker

This section covers:

  • User-initiated shutdowns
  • Sudden shutdowns
  • Predefined and custom reasons for shutting down


User-initiated shutdowns

You can initiate a shutdown from the Start menu, or by calling shutdown.exe. With this type of shutdown Windows performs certain procedures, including prompting the user to specify a shutdown or restart reason.

A shutdown not initiated by using one of the previous methods is called a "sudden shutdown." A sudden shutdown can result from a power outage or a system failure. For more information, see Sudden shutdowns.


Sudden shutdowns

A shutdown that is not user-initiated is considered a "sudden" or "unexpected" shutdown. For example, a power outage or a system failure can cause a sudden shutdown. Sudden shutdowns do not allow Windows to perform all of the normal procedures during the shutdown sequence, including collecting information about the shutdown reason. Therefore, if a sudden shutdown occurs, you will be prompted to enter a shutdown reason upon restarting.

For more information about using Shutdown Event Tracker for sudden shutdowns, see Using Shutdown Event Tracker for sudden shutdowns. For general information about Shutdown Event Tracker, see Shutdown Event Tracker overview.


Predefined and custom reasons for shutting down

Predefined Reasons

When you have Shutdown Event Tracker enabled, Windows provides predefined reasons that appear in the Option drop-down list when you shut down your computer. These reasons cannot be edited or renamed. You can, however, choose not to use the predefined reasons and define all of your own shutdown reasons instead.

You must have at least one correctly defined custom reason before you can turn off the predefined reasons. For more information on defining custom shutdown reasons, see To add your own shutdown reasons.

To turn off predefined reasons, see To turn off predefined reasons.

Custom reasons

As an administrator, you can add your own custom reasons for user-initiated or a sudden shutdowns. You can define each custom reason and further specify it. For example, a reason defined as "InternalApplication" can be further specified as either "InternalApplication: Maintenance" or "InternalApplication: Installation." In this example, the major reason (represented by a corresponding major reason code) is InternalApplication, and the minor reason (represented by a corresponding minor reason code) is either "Maintenance" or "Installation." You can specify the reason even further by adding "(Planned)" or "(Unplanned)" as part of your minor reason description. Then, when shutting down or restarting, you can choose from among the following reasons:

  • InternalApplication: Maintenance (Planned)
  • InternalApplication: Maintenance (Unplanned)
  • InternalApplication: Installation (Planned)
  • InternalApplication: Installation (Unplanned)

In order for the custom shutdown reason text to be logged in Event Viewer, you must first define the custom shutdown reason on each computer for which you plan to use that particular reason. For more information on defining custom shutdown reasons, see To add your own shutdown reasons.


Using Shutdown Event Tracker

This section covers:

  • Using Shutdown Event Tracker for user-initiated shutdowns
  • Using Shutdown Event Tracker for sudden shutdowns


Using Shutdown Event Tracker for user-initiated shutdowns

When you methodically shut down your computer, Shutdown Event Tracker prompts you to specify the reason for the shutdown. These reasons are then recorded in Event Viewer.

For more information on viewing shutdown reasons in Event Viewer, see To review Shutdown Event Tracker data.

You can supplement the default reasons provided by Windows with your own custom reasons. For more information, see To add your own shutdown reasons.


Using Shutdown Event Tracker for sudden shutdowns

A shutdown that is not initiated by a user is considered a "sudden" or "unexpected" shutdown. A sudden shutdown can occur when there is a power outage or a system failure. The first user with Administrator privileges who logs back into the computer after an sudden shutdown is presented with a dialog box where the reason for the shutdown can be indicated. You can choose from the following options when tracking the reason for a sudden or shutdown:

  • System failure: Stop error
  • Power failure: Cord unplugged
  • Power failure: Environment
  • Other failure: System unresponsive
In addition to these reasons, Shutdown Event Tracker provides a Problem ID box that you can use to record a unique identifier that corresponds to your trouble ticket system, and a Comment box where you can comment more fully on the reason for the sudden shutdown. You must fill in this text box when you choose Other.

These reasons are then recorded in Event Viewer. For more information on viewing shutdown reasons in Event Viewer, see To review Shutdown Event Tracker data.

You can supplement or replace the default reasons supplied by Windows with your own custom reasons. For more information about this, see To add your own shutdown reasons.

You must supply a reason following a sudden shutdown. If, after starting the computer following a sudden shutdown, you do not choose a shutdown reason within two minutes, Windows will log you off of the system and return to the initial logon screen.

You can only specify a reason for the most recent time you restarted your computer.


Managing the Shutdown Event Tracker from the command line

Microsoft Windows graphic

Managing Shutdown Event Tracker from the command line

In addition to using the Shut Down Windows dialog box to record reasons for shutting down or restarting, you can record shutdown and restart reasons from a command line. For more information, see To shutdown and document the reason.

When you use a command line to shutdown or restart a computer, you can supply several optional parameters, including the major and minor reason codes. For more information, see Shutdown.

For information about other command-line utilities, see Command-line reference A-Z.


Troubleshooting

What problem are you having?

Shutdown Event Tracker does not appear when you shutdown your computer.

Cause: Shutdown Event Tracker is disabled.

Solution: Enable Shutdown Event Tracker.

See also: To enable Shutdown Event Tracker.

You initiated the shutdown sequence using a command line, but the proper shutdown reason text does not appear in Event Viewer.

Cause: The correct reason codes were not used. When using a command line to shutdown and document a shutdown reason, the major and minor reason codes specified in the command must be defined on the computer that is being shut down. If these codes are not defined, the resulting entry in Event Viewer will reflect the same codes that were used in the shutdown command, but the incorrect text will be displayed.

Solution: Define the reason codes on the computer to be shutdown.

See also: To add your own shutdown reasons

The OK button is disabled after you choose a shutdown reason.

Cause: A text entry is required for this reason option.

Solution: Type the information in the text box provided.

See also: Using Shutdown Event Tracker for user-initiated shutdowns; Using Shutdown Event Tracker for sudden shutdowns.