Windows server 2008 r2 shutdown event tracker
Description of the Shutdown Event Tracker
This article describes the Shutdown Event Tracker.
Summary
Shutdown Event Tracker is a Microsoft Windows Server 2003 and Microsoft Windows XP feature that you can use to consistently track the reason for system shutdowns. You can then use this information to analyze shutdowns and to develop a more comprehensive understanding of your system environment. Shutdown Event Tracker logs events that are similar to the following in the system event log:
More information
Windows Server 2003 and Windows XP 64-Bit Edition Version 2003
By default, Shutdown Event Tracker is enabled for all Windows Server 2003 operating systems and for Windows XP 64-Bit Edition Version 2003.
To disable Shutdown Event Tracker on all Windows Server 2003 operating systems and in Windows XP 64-Bit Edition Version 2003, disable the Display Shutdown Event Tracker policy by using Group Policy. To do it by using Local Group Policy, follow these steps:
Windows XP Professional
By default, Shutdown Event Tracker is disabled in Windows XP Professional.
To enable Shutdown Event Tracker in Windows XP Professional, in Windows XP Tablet PC Edition, and in Windows XP Media Center Edition, enable the Display Shutdown Event Tracker policy by using Group Policy. To do it by using Local Group Policy, follow these steps:
Shutdown Event Tracker isn’t a functional component in Windows XP Home Edition. So you can’t use Shutdown Event Tracker in Windows XP Home Edition.
Microsoft recommends that you don’t enable the Shutdown Event Tracker in Windows XP Professional, Windows XP Tablet PC, or Windows XP Media Center Editions. Microsoft doesn’t support the use of this component in these Windows XP environments.
Custom Options for identifying a shutdown cause
This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information, see How to back up and restore the registry in Windows.
Windows provides a list of eight generic reasons why your computer was shut down. You can modify this list to include your own custom reasons. To add your own reasons, follow these steps:
Start Registry Editor.
Locate and then select the following registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Reliability\UserDefined
On the Edit menu, select New, and then select Multi-String Value. Which creates the new key and gives it the temporary name «New Value.»
Type the name of the registry key in the following format, and then press ENTER: UI_control_flags; major_reason_number; minor_reason_number
The UI_control_flags section of the value name can contain one or more of the following values:
Double-click the new key, and then define the value data in the following format:
Each value is made up of two strings on separate lines; the first string is the title (it’s displayed in the list) and the second string is the description (it’s the text that is displayed following the selected reason).
For example, if you want to create a custom reason for a natural disaster, you can define the value data as follows: Natural Disaster (unplanned)
A flood, an earthquake, a tornado, or another unplanned natural event requires that the computer shuts down. Specify the natural event in the comment area.
Описание отслеживания событий завершения работы
В этой статье описывается отслеживание событий завершения работы.
Исходная версия продукта: Windows 10 — все выпуски, Windows Server 2012 R2
Исходный номер КБ: 293814
Аннотация
Отслеживание событий завершения работы — это функция Microsoft Windows Server 2003 и Microsoft Windows XP, которую можно использовать для согласованного отслеживания причины отключения системы. Затем эти сведения можно использовать для анализа завершения работы и разработки более полного понимания системной среды. Отслеживание событий завершения работы занося в журнал событий, аналогичных следующим событиям системы:
Дополнительные сведения
Windows Server 2003 и Windows XP 64-Bit Edition версии 2003
По умолчанию отслеживание событий завершения работы включено для всех операционных систем Windows Server 2003 и Windows XP 64-Bit Edition версии 2003.
Чтобы отключить отслеживание событий завершения работы во всех операционных системах Windows Server 2003 и Windows XP 64-Bit Edition версии 2003, отключать политику отслеживания событий завершения работы с помощью групповой политики. Чтобы сделать это с помощью локальной групповой политики, выполните следующие действия:
Windows XP Professional
По умолчанию в Windows XP Professional отключено отслеживание событий завершения работы.
Чтобы включить отслеживание событий завершения работы в Windows XP Professional, Windows XP Tablet PC Edition и Windows XP Media Center Edition, включите политику отслеживания событий завершения работы с помощью групповой политики. Чтобы сделать это с помощью локальной групповой политики, выполните следующие действия:
Отслеживание событий завершения работы не является функциональным компонентом в Windows XP Home Edition. Поэтому вы не можете использовать отслеживание событий завершения работы в Windows XP Home Edition.
Корпорация Майкрософт рекомендует не включить отслеживание событий завершения работы в Windows XP Professional, планшетном ПК с Windows XP или Windows XP Media Center Edition. Корпорация Майкрософт не поддерживает использование этого компонента в этих средах Windows XP.
Настраиваемые параметры для определения причины завершения работы
В этот раздел, описание метода или задачи включены действия, содержащие указания по изменению параметров реестра. Однако неправильное изменение параметров реестра может привести к возникновению серьезных проблем. Поэтому следует в точности выполнять приведенные инструкции. Для дополнительной защиты создайте резервную копию реестра, прежде чем редактировать его. Так вы сможете восстановить реестр, если возникнет проблема. Дополнительные сведения см. в сведениях о том, как создать и восстановить реестр в Windows.
Windows предоставляет список из восьми универсальных причин, по которым компьютер был отключен. Этот список можно изменить, включив в него собственные настраиваемые причины. Чтобы добавить собственные причины, выполните следующие действия:
Откройте редактор реестра.
Найдите и выберите следующий ключ реестра: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Reliability\UserDefined
В меню «Правка» выберите «Новый» и «Много строка». При этом создается новый ключ с временным именем «New Value».
Введите имя ключа реестра в следующем формате и нажмите клавишу ВВОД: UI_control_flags; major_reason_number; minor_reason_number
Раздел UI_control_flags имени значения может содержать одно или несколько из следующих значений:
Дважды щелкните новый ключ и определите данные значения в следующем формате:
Каждое значение состоит из двух строк на отдельных строках; Первая строка является заголовком (она отображается в списке), а вторая строка — описанием (это текст, который отображается по выбранной причине).
Например, если вы хотите создать настраиваемую причину аварии, можно определить данные значения следующим образом: Natural Disaster (unplanned)
Чтобы компьютер был выключен, необходимо, чтобы компьютер был остановлен из-за затравки, а также от хлама или другого незапланированного естественного события. Укажите естественное событие в области комментария.
Windows server 2008 r2 shutdown event tracker
This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.
Answered by:
Question
Hello, and thanks for reading this question.
There was a way to disable Shutdown Event Tracker in Server 2003. The line for this option is gone in Group Policy Editor in Server 2008, as far as I can see. Can anyone point to the right folder path for Server 2008, or give a safe reg change to do so?
I’m not using this function, and it’s just getting in the way.
Many many thanks, and happy weekend!
Answers
According to your description, I have test it on Windows Server 2008 RC1 and find the «Display Shutdown Event Tracker» in Group Policy Editor.
Don’t forget to «gpupdate /force» to force refresh the GPO.
Please kindly find the option in Group Policy Editor, I think the GPO of Windows Server 2008 is similiar to Windows Server 2003.
Thanks for your time.
All replies
According to your description, I have test it on Windows Server 2008 RC1 and find the «Display Shutdown Event Tracker» in Group Policy Editor.
Don’t forget to «gpupdate /force» to force refresh the GPO.
Please kindly find the option in Group Policy Editor, I think the GPO of Windows Server 2008 is similiar to Windows Server 2003.
Thanks for your time.
computer configuration..
Administrative Templates..
System..
Display Shutdown Event Tracker
double click..
check on Disabled..
Apply..
OK..
Windows Registry Editor Version 5.00
Before anyone else replies with the Cut-And-Paste, straight-off TechNet answer regurgitation about disabling «Display Shutdown Event Tracker» please read this:
The ONLY way I was able to get the Shutdown Event Tracker turned off was via the registry.
This may have applied to RC1 or RC2, but in the retail and Action Pack releases of 2008 Standard (both 64bit and 32bit), the Display Shutdown Event Tracker option is not listed under System, or anywhere else that I can find, for that matter.
Use Alfredo’s helpful registry entry (above) and merge it in. It works like a champ.
User inadvertently selected shutdown in Server 2008. Is there any way of stopping the shutdown, once the Shutdown Event Tracker appears?
Again, you are incorrect. I have 2008 sp1 and it’s there.
I guess it must depend on exactly which group policy templates you have on your domain.
On my domain at home, I have no need for the shutdown tracker so I have it disabled in the GPO.
Windows server 2008 r2 shutdown event tracker
Вопрос
Hello, and thanks for reading this question.
There was a way to disable Shutdown Event Tracker in Server 2003. The line for this option is gone in Group Policy Editor in Server 2008, as far as I can see. Can anyone point to the right folder path for Server 2008, or give a safe reg change to do so?
I’m not using this function, and it’s just getting in the way.
Many many thanks, and happy weekend!
Ответы
According to your description, I have test it on Windows Server 2008 RC1 and find the «Display Shutdown Event Tracker» in Group Policy Editor.
Don’t forget to «gpupdate /force» to force refresh the GPO.
Please kindly find the option in Group Policy Editor, I think the GPO of Windows Server 2008 is similiar to Windows Server 2003.
Thanks for your time.
Все ответы
According to your description, I have test it on Windows Server 2008 RC1 and find the «Display Shutdown Event Tracker» in Group Policy Editor.
Don’t forget to «gpupdate /force» to force refresh the GPO.
Please kindly find the option in Group Policy Editor, I think the GPO of Windows Server 2008 is similiar to Windows Server 2003.
Thanks for your time.
computer configuration..
Administrative Templates..
System..
Display Shutdown Event Tracker
double click..
check on Disabled..
Apply..
OK..
Windows Registry Editor Version 5.00
Before anyone else replies with the Cut-And-Paste, straight-off TechNet answer regurgitation about disabling «Display Shutdown Event Tracker» please read this:
The ONLY way I was able to get the Shutdown Event Tracker turned off was via the registry.
This may have applied to RC1 or RC2, but in the retail and Action Pack releases of 2008 Standard (both 64bit and 32bit), the Display Shutdown Event Tracker option is not listed under System, or anywhere else that I can find, for that matter.
Use Alfredo’s helpful registry entry (above) and merge it in. It works like a champ.
User inadvertently selected shutdown in Server 2008. Is there any way of stopping the shutdown, once the Shutdown Event Tracker appears?
Again, you are incorrect. I have 2008 sp1 and it’s there.
I guess it must depend on exactly which group policy templates you have on your domain.
On my domain at home, I have no need for the shutdown tracker so I have it disabled in the GPO.
How to disable the Shutdown Event Tracker in Windows Server 2008 R2
Some IT departments are under governmental and/or industry regulations that require them to account for all system downtime. Other IT departments may be mandated by their service-level agreements (SLAs) to provide documentation for any server restarts or shutdowns.
In Microsoft Windows Server 2008 R2, we have the Shutdown Event Tracker to assist us in not only the previously mentioned scenarios, but also for any shutdown-related troubleshooting we may be called to undertake.
How the Shutdown Event Tracker works ^
In a nutshell, the Shutdown Event Tracker enables Windows systems administrators to provide a reason for any system shutdown or restart event. Let’s clear up some terminology before we proceed any further:
When you perform an orderly shutdown or restart in Windows Server 2008 R2, the default behavior of the operating system is to display the Shutdown Event Tracker dialog box. This is shown in the next figure:
Shutdown Event Tracker dialog
The systems administrator has an opportunity to (a) specify whether the event is planned or unplanned; (b) choose an event category; and (c) provide a comment.
Shutdown-related events are stored in the System event log under Event ID 1074. You should periodically filter this log to isolate and review shutdown-related events.
Shutdown Event Tracker events in Event Log
If your server crashes or suffers an otherwise unexpected restart, the Shutdown Event Tracker is invoked automatically upon the first administrator logon to the system.
How to Disable the Shutdown Event Tracker
If you want to disable the Shutdown Event Tracker, you can do so either by modifying the local Group Policy of the target system, or by editing the Windows Registry.
To use the Group Policy method, open the Run dialog box from the start menu and type gpedit.msc to open the machine’s local Group Policy.
NOTE: You can manage the Shutdown Event Tracker for multiple systems through Active Directory Group Policy.
In Group Policy Editor, navigate to Computer Configuration\Administrative Templates\System, open the Display Shutdown Event Tracker policy, and set it to Disabled. This process is shown in the following screen capture:
Disable Shutdown Event Tracker through Group Policy
If you prefer to use the Registry to perform this action, then type regedit from the Run dialog or an administrative command prompt and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Reliability. Next, open the ShutdownReasonOn value and set it to 0.
Disable Shutdown Event Tracker through Group Policy
Conclusion ^
By now you should understand the purpose and basic functionality of the Shutdown Event Tracker in Windows Server 2008 R2. You also should know how to disable the feature by using either Group Policy or the Windows Registry.