Forum
Merhabalar, sistemimde 2000 ve 2003 sunucular mevcut, Bu sunucuları hangi user ın kapattığını, restart ettiğini görmek istiyorum. Event viewer da bu mümkün mü?
Baska bir oneriniz var mı
Description of the Shutdown Event Tracker
function loadTOCNode(){}
Article ID | : | 293814 |
Last Review | : | January 31, 2007 |
Revision | : | 4.4 |
On This Page
var sectionFilter = "type != 'notice' && type != 'securedata' && type != 'querywords'";
var tocArrow = "/library/images/support/kbgraphics/public/en-us/downarrow.gif";
var depthLimit = 10;
var depth3Limit = 10;
var depth4Limit = 5;
var depth5Limit = 3;
var tocEntryMinimum = 1;
SUMMARY
loadTOCNode(1, 'summary');
Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 6/26/2003
Time: 1:53:20 PM
User: domain\username
Computer: computername
Description: The process Explorer.EXE has initiated the shutdown of computer computername on behalf of user domain\username for the following reason:
Hardware: Maintenance (Planned)
Reason Code: 0x84010001
Shutdown Type: shutdown
Comment: Replacing Hard Drive
For more information, see Help and Support Center at http://support.microsoft.com. Data: 0000: 01 00 01 84 ...
MORE INFORMATION
loadTOCNode(1, 'moreinformation');
Windows Server 2003 and Windows XP 64-Bit Edition Version 2003
loadTOCNode(2, 'moreinformation');
By default, Shutdown Event Tracker is enabled for all Windows Server 2003 operating systems and for Windows XP 64-Bit Edition Version 2003.
To disable Shutdown Event Tracker on all Windows Server 2003 operating systems and in Windows XP 64-Bit Edition Version 2003, disable the Display Shutdown Event Tracker policy by using Group Policy. To do this by using Local Group Policy, follow these steps:
1. | Click Start, and then click Run. |
2. | Type gpedit.msc, and then click OK. |
3. | Expand Computer Configuration, expand Administrative Templates, and then expand System. |
4. | Double-click Display Shutdown Event Tracker. |
5. | Click Disabled, and then click OK. |
Windows XP Professional
loadTOCNode(2, 'moreinformation');
By default, Shutdown Event Tracker is disabled in Windows XP Professional.
To enable Shutdown Event Tracker in Windows XP Professional, in Windows XP Tablet PC Edition, and in Windows XP Media Center Edition, enable the Display Shutdown Event Tracker policy by using Group Policy. To do this by using Local Group Policy, follow these steps:
1. | Click Start, and then click Run. |
2. | Type gpedit.msc, and then click OK. |
3. | Expand Computer Configuration, expand Administrative Templates, and then expand System. |
4. | Double-click Display Shutdown Event Tracker. |
5. | Click Enabled. |
6. | In the Shutdown Event Tracker should be displayed box, click Always, and then click OK. |
Note Microsoft recommends that you do not enable the Shutdown Event Tracker in Windows XP Professional, Windows XP Tablet PC, or Windows XP Media Center Editions. Microsoft does not support the use of this component in these Windows XP environments.
Custom Options for Identifying a Shutdown Cause
loadTOCNode(2, 'moreinformation');
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
Windows provides a list of eight generic reasons why your computer was shut down. You can modify this list to include your own custom reasons. To add your own reasons, follow these steps:
1. | Start Registry Editor. | ||||||||
2. | Locate and then click the following registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Reliability\UserDefined | ||||||||
3. | On the Edit menu, click New, and then click Multi-String Value. This creates the new key and gives it the temporary name "New Value." | ||||||||
4. | Type the name of the registry key in the following format, and then press ENTER: UI_control_flags;major_reason_number;minor_reason_number The UI_control_flags section of the value name can contain one or more of the following values:
D;2;2 | ||||||||
5. | Double-click the new key, and then define the value data in the following format: Title Each value is made up of two strings on separate lines; the first string is the title (this is displayed in the list) and the second string is the description (this is the text that is displayed following the selected reason).Description For example, if you want to create a custom reason for a natural disaster, you can define the value data as follows: Natural Disaster (unplanned) A flood, an earthquake, a tornado, or another unplanned natural event requires that the computer be shut down. Specify the natural event in the comment area. | ||||||||
6. | Quit Registry Editor. |
Notes
loadTOCNode(2, 'moreinformation');
• | You can specify both S and D for UI_control_flags, but you must specify at least one of them for the parameters to be valid. |
• | If the UI_control_flags section contains any characters other than the characters that are listed in the "Custom Options for Identifying a Shutdown Cause" section of this article, or if the UI_control_flags section exceeds five characters, the message is not valid and is not displayed in the user interface. You can specify that the characters appear in any order. |
• | The major_reason_number is a number from 0 through 255. If this section is left blank, if it contains a number that is not in the valid range, or if it contains a number that is not an integer, the message is not valid and is not displayed in the user interface. |
• | The minor_reason_number is a number from 0 through 65,536. If this section is left blank, if it contains a number that is not in the valid range, or if it contains a number that is not an integer, the message is not valid and is not displayed in the user interface. |
• | The custom reasons are sorted in the user interface by two keys in the following order: MajorReasonNumber, MinorReasonNumber. |
• | The maximum length for the title is 64 characters, and the maximum length for the description is 96 characters. |
• | If you set the following registry key to any non-zero value, and you have correctly defined at least one custom reason, the standard Windows reasons are not displayed in the Shut Down Windows dialog box: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\ShutdownIgnorePredefinedReasons |