Description of the Shutdown Event Tracker

This article describes the Shutdown Event Tracker.

Original product version: В Windows 10 — all editions, Windows Server 2012 R2
Original KB number: В 293814

Summary

Shutdown Event Tracker is a Microsoft Windows Server 2003 and Microsoft Windows XP feature that you can use to consistently track the reason for system shutdowns. You can then use this information to analyze shutdowns and to develop a more comprehensive understanding of your system environment. Shutdown Event Tracker logs events that are similar to the following in the system event log:

More information

Windows Server 2003 and Windows XP 64-Bit Edition Version 2003

By default, Shutdown Event Tracker is enabled for all Windows Server 2003 operating systems and for Windows XP 64-Bit Edition Version 2003.

To disable Shutdown Event Tracker on all Windows Server 2003 operating systems and in Windows XP 64-Bit Edition Version 2003, disable the Display Shutdown Event Tracker policy by using Group Policy. To do it by using Local Group Policy, follow these steps:

1. Select Start, and then select Run.
2. Type gpedit.msc, and then select OK.
3. Expand Computer Configuration, expand Administrative Templates, and then expand System.
4. Double-click Display Shutdown Event Tracker.
5. Select Disabled, and then select OK.

Windows XP Professional

By default, Shutdown Event Tracker is disabled in Windows XP Professional.

To enable Shutdown Event Tracker in Windows XP Professional, in Windows XP Tablet PC Edition, and in Windows XP Media Center Edition, enable the Display Shutdown Event Tracker policy by using Group Policy. To do it by using Local Group Policy, follow these steps:

1. Select Start, and then select Run.
2. Type gpedit.msc, and then select OK.
3. Expand Computer Configuration, expand Administrative Templates, and then expand System.
4. Double-click Display Shutdown Event Tracker.
5. Select Enabled.
6. In the Shutdown Event Tracker should be displayed box, select Always, and then select OK.

Shutdown Event Tracker isn’t a functional component in Windows XP Home Edition. So you can’t use Shutdown Event Tracker in Windows XP Home Edition.

Microsoft recommends that you don’t enable the Shutdown Event Tracker in Windows XP Professional, Windows XP Tablet PC, or Windows XP Media Center Editions. Microsoft doesn’t support the use of this component in these Windows XP environments.

Custom Options for identifying a shutdown cause

This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information, see How to back up and restore the registry in Windows.

Windows provides a list of eight generic reasons why your computer was shut down. You can modify this list to include your own custom reasons. To add your own reasons, follow these steps:

Start Registry Editor.

Locate and then select the following registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Reliability\UserDefined

On the Edit menu, select New, and then select Multi-String Value. Which creates the new key and gives it the temporary name «New Value.»

Type the name of the registry key in the following format, and then press ENTER: UI_control_flags; major_reason_number; minor_reason_number
The UI_control_flags section of the value name can contain one or more of the following values:

• P (Indicates that the reason is planned. If this value is omitted, the default is unplanned.)
• C or B (Indicates that a comment is required.)
• S (Indicates that the reason should be displayed in the user-initiated shutdown dialog box.)
• D (Indicates that the reason should be displayed in the sudden shutdown dialog box.)For example, if you want a reason to be displayed in the sudden shutdown dialog box, the shutdown is unplanned, and the shutdown corresponds to a major reason 2 and to a minor reason 2, type the following value name: D;2;2

Double-click the new key, and then define the value data in the following format:

Each value is made up of two strings on separate lines; the first string is the title (it’s displayed in the list) and the second string is the description (it’s the text that is displayed following the selected reason).

For example, if you want to create a custom reason for a natural disaster, you can define the value data as follows: Natural Disaster (unplanned)

A flood, an earthquake, a tornado, or another unplanned natural event requires that the computer shuts down. Specify the natural event in the comment area.

Windows 2019 shutdown event tracker

Вопрос

Hi I have a recently installed a freh copy of Sever 2019 and promoted as a Domain Controller — Global Cat.

Every time i login i get this.

Any ideas why as the server clearly hasn’t rebooted.

The server in running in Hyper-v on a server 2016 image. Dell T440

Все ответы

I’d check the server has the latest ROM bios, firmware, chipset and driver support pack from Dell. The chipset allows the operating system to find and use devices integrated into the mother board.

Regards, Dave Patrick .
Microsoft Certified Professional
Microsoft MVP [Windows Server] Datacenter Management

Disclaimer: This posting is provided «AS IS» with no warranties or guarantees, and confers no rights.

Shutdown Event Tracker

You can disable it from the registry, but I would not recommend it.

You can create a GPO any apply it to the servers you want. Navigate to Computer Configuration > Administrative Templates > System and in the right hand pane, select the “Display Shutdown Event Tracker” setting.

Описание отслеживания событий завершения работы

В этой статье описывается отслеживание событий завершения работы.

Исходная версия продукта: Windows 10 — все выпуски, Windows Server 2012 R2
Исходный номер КБ: 293814

Аннотация

Отслеживание событий завершения работы — это функция Microsoft Windows Server 2003 и Microsoft Windows XP, которую можно использовать для согласованного отслеживания причины отключения системы. Затем эти сведения можно использовать для анализа завершения работы и разработки более полного понимания системной среды. Отслеживание событий завершения работы занося в журнал событий, аналогичных следующим событиям системы:

Дополнительные сведения

Windows Server 2003 и Windows XP 64-Bit Edition версии 2003

По умолчанию отслеживание событий завершения работы включено для всех операционных систем Windows Server 2003 и Windows XP 64-Bit Edition версии 2003.

Чтобы отключить отслеживание событий завершения работы во всех операционных системах Windows Server 2003 и Windows XP 64-Bit Edition версии 2003, отключать политику отслеживания событий завершения работы с помощью групповой политики. Чтобы сделать это с помощью локальной групповой политики, выполните следующие действия:

1. Нажмите кнопку Пуск и выберите пункт Выполнить.
2. Введите gpedit.msc и выберите «ОК».
3. Раз развернуть конфигурацию компьютера, развернуть административные шаблоны, а затем развернуть «Система».
4. Дважды щелкните display Shutdown Event Tracker.
5. Выберите «Отключено» и «ОК»

Windows XP Professional

По умолчанию в Windows XP Professional отключено отслеживание событий завершения работы.

Чтобы включить отслеживание событий завершения работы в Windows XP Professional, Windows XP Tablet PC Edition и Windows XP Media Center Edition, включите политику отслеживания событий завершения работы с помощью групповой политики. Чтобы сделать это с помощью локальной групповой политики, выполните следующие действия:

1. Нажмите кнопку Пуск и выберите пункт Выполнить.
2. Введите gpedit.msc и выберите «ОК».
3. Раз развернуть конфигурацию компьютера, развернуть административные шаблоны, а затем развернуть «Система».
4. Дважды щелкните display Shutdown Event Tracker.
5. Щелкните Включено.
6. В окне «Отслеживание событий завершения работы» выберите «Всегда» и выберите «ОК».

Отслеживание событий завершения работы не является функциональным компонентом в Windows XP Home Edition. Поэтому вы не можете использовать отслеживание событий завершения работы в Windows XP Home Edition.

Корпорация Майкрософт рекомендует не включить отслеживание событий завершения работы в Windows XP Professional, планшетном ПК с Windows XP или Windows XP Media Center Edition. Корпорация Майкрософт не поддерживает использование этого компонента в этих средах Windows XP.

Настраиваемые параметры для определения причины завершения работы

В этот раздел, описание метода или задачи включены действия, содержащие указания по изменению параметров реестра. Однако неправильное изменение параметров реестра может привести к возникновению серьезных проблем. Поэтому следует в точности выполнять приведенные инструкции. Для дополнительной защиты создайте резервную копию реестра, прежде чем редактировать его. Так вы сможете восстановить реестр, если возникнет проблема. Дополнительные сведения см. в сведениях о том, как создать и восстановить реестр в Windows.

Windows предоставляет список из восьми универсальных причин, по которым компьютер был отключен. Этот список можно изменить, включив в него собственные настраиваемые причины. Чтобы добавить собственные причины, выполните следующие действия:

Откройте редактор реестра.

Найдите и выберите следующий ключ реестра: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Reliability\UserDefined

В меню «Правка» выберите «Новый» и «Много строка». При этом создается новый ключ с временным именем «New Value».

Введите имя ключа реестра в следующем формате и нажмите клавишу ВВОД: UI_control_flags; major_reason_number; minor_reason_number
Раздел UI_control_flags имени значения может содержать одно или несколько из следующих значений:

• P (указывает, что причина запланирована. Если это значение опущено, значение по умолчанию является незапланированным.)
• C или B (указывает, что требуется комментарий).)
• S (указывает, что причина должна отображаться в диалоговом окне завершения работы, инициированном пользователем.)
• Г (указывает, что причина должна отображаться в диалоговом окне неожиданного завершения работы.) Например, если вы хотите, чтобы причина отображалась в диалоговом окне неожиданного завершения работы, завершение работы будет незапланированным, а завершение работы соответствует основной причине 2 и по второстепенной причине 2, введите следующее имя значения: D;2;2

Дважды щелкните новый ключ и определите данные значения в следующем формате:

Каждое значение состоит из двух строк на отдельных строках; Первая строка является заголовком (она отображается в списке), а вторая строка — описанием (это текст, который отображается по выбранной причине).

Например, если вы хотите создать настраиваемую причину аварии, можно определить данные значения следующим образом: Natural Disaster (unplanned)

Чтобы компьютер был выключен, необходимо, чтобы компьютер был остановлен из-за затравки, а также от хлама или другого незапланированного естественного события. Укажите естественное событие в области комментария.

Windows 2019 shutdown event tracker

This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.

Asked by:

Question

After an unexpected shutdown the shutdown event tracker keeps appearing after a logon, even when a reason was provided.

This occurs after installing KB4490481 (April 2, 2019) for Windows Server 2019

Does anyone else suffer from this?

All replies

KB 4490481 has been replaced by KB 4493509. Please update windows server 2019 to KB4493509. Then check the issue again.

If the issue persists, you could uninstall the KB4490481 or disable the shutdown event tracker.

Disable Display Shutdown Event Tracker for user login only?

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

Issue still persist in KB 4493509

Unexpected shutdown notification is no longer appearing after the following setting using a GPO:
Computer Configuration > Administrative Templates > System > «Display Shutdown Event Tracker» = Disabled

This setting will disable the shutdown tracking for a system for expected and unexpected shutdowns.

• Edited by Olivier Venerius Friday, April 12, 2019 9:04 AM Typo
• Proposed as answer by David_Ding2018 Microsoft contingent staff Monday, May 6, 2019 2:56 PM

Thanks for sharing us.

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

Got the same issue on all of my VMs apart from my second DC. Hopefully they’ll resolve this soon as I don’t want to disable the shutdown event tracker completely in case it is actually an unexpected shutdown.

Bizarrely for me this doesn’t even appear just after reboots but also whenever I log onto an affected server

Find this post helpful? Does this post answer your question? Be sure to mark it appropriately to help others find answers to their searches.

We are having this issue, too. We are using Windows Server 2019 Standard (.437).

To my knowledge, we are not seeing it on Windows Server 2016 Standard.

Yes same issue for us on Server 2019.

I had this problem, the solution is to clear all the values (like DirtyShutdown, LastAliveStamp, TimeStampInterval) in the following registry key:

At the next reboot the problem should not be popping up, unless there is another dirty shut down.

Find this post helpful? Does this post answer your question? Be sure to mark it appropriately to help others find answers to their searches.

You can safely delete all the values mentioned, for example, my system has the following values, DirtyShutdown, DirtyShutdownTime, LastAliveStamp, TimeStampInterval, LastComputerName

They will be recreated as needed. You can make a backup of the registry entry if you want.

Find this post helpful? Does this post answer your question? Be sure to mark it appropriately to help others find answers to their searches.

Thank you! I had a Hper-V host crash a month or so back, and since then everytime i logged into that host and any VMs that were o that host at the time have been repeatedly showing this..

Thanks! This was driving me CRAZY!

Maybe my answer was to short.

I had the same issue. While searching for a solution I found this thread.

The message box what requests the reason for a system crash appeared again and again, even if I answered it as Domain Admin. This is a sign that there is something wrong with the permissions to write in the system. Maybe the patch in question changed something in the behavior of admin accounts.

It seems that only the predefined administrator account has the permission to write the answer to this message box in the system.

If you meant, the original question was only who had the same issue, ok, in this case my answer had should be only «me too». 😉

Dear Ms. Barbara,

your solution is just simply perfect!

— When you hit a wrong note its the next note that makes it good or bad. — Miles Davis

This seems to be an issue specific to Windows Server 2019 with the registry permissions for the Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability key.

After examining the permissions for that registry key on both Windows Server 2016 and Windows Server 2019, I see that Server 2016 gives full control to our DomainName\Administrators group, whereas Server 2019 only gives full control to that server’s LocalServerName\Administrators group.

This explains why only the local Administrator account on Server 2019 has the ability to set the DirtyShutdown value to 0.

Hopefully Microsoft can fix this with an update, as I’d hate to manually have to adjust this value across multiple servers every time a dirty shutdown occurs.

— When you hit a wrong note its the next note that makes it good or bad. — Miles Davis

» The question is, it’s a bug or a feature»

OK, coming from Microsoft. that’s too funny

I had this problem, the solution is to clear all the values (like DirtyShutdown, LastAliveStamp, TimeStampInterval) in the following registry key:

At the next reboot the problem should not be popping up, unless there is another dirty shut down.

Thank you. That was driving me barmy, it was even coming up for end users on an RDS deployment regardless of the Group Policy Setting to disable it.

Happened with every login too, rather than an actual shutdown/reboot event.

The message disappears if you logon to the server with the predefined local Administrator account (SID 500) and answer the message.

Logging on to console and logging in as Administrator and entering reason fixed for me.

>> Logging on to console and logging in as Administrator and entering reason fixed for me.

I also found logging in with Administrator and entering reason prevented the false unexpected shutdown message from appearing during next log on.

I did create a backup export for the registry key. I tested with just removing the «DirtyShutdown» and «DirtyShutdownTime» and that worked, no message on reboot. I did not do the others including «LastAliveStamp», as the value was the same on bad computer as it was on good computer.

Find this post helpful? Does this post answer your question? Be sure to mark it appropriately to help others find answers to their searches.

It works for me. Thankyou.

I wonder why Windows Server 2019 at this time still got such bug.

This seems to be an issue specific to Windows Server 2019 with the registry permissions for the Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability key.

After examining the permissions for that registry key on both Windows Server 2016 and Windows Server 2019, I see that Server 2016 gives full control to our DomainName\Administrators group, whereas Server 2019 only gives full control to that server’s LocalServerName\Administrators group.

This explains why only the local Administrator account on Server 2019 has the ability to set the DirtyShutdown value to 0.

Hopefully Microsoft can fix this with an update, as I’d hate to manually have to adjust this value across multiple servers every time a dirty shutdown occurs.