Shutdown

  • Thread starter Thread starter Dave Swanson
  • Start date Start date
D

Dave Swanson

How can I determine who shutdown/rebooted a computer? I know the system
logs shows an eventid 6006 for a clean shutdown. When I look through the
security log, I'm seeing anything indicating that someone actually initiated
the shutdown/reboot. Any ideas?


TIA
 
Enable auditing of logon events on the computers. Then you can correlate the
user log off with the shutdown by time, assuming it was not shut down
remotely by someone with administrator priviliges. --- Steve
 
I was actually logged onto the box and getting ready to do some fixes and
before I could get started, it rebooted on me. The last logoff was from
ANONYMOUS before the reboot.

I would think that there would be a security and/or system event that would
say a shutdown/restart as been initiated by USERNAME somewhere in the log.
 
Back
Top