Search code examples
windows-server-2008shutdown

How to tell if a Windows server is in the act of shutting down


I'm working on Windows Server 2008. Is there a way to tell (via the command line) if a server is in the act of shutting down? I searched for this but have been unable to find a way.


Solution

  • Your best bet would be to query the system event log. If someone runs the shutdown command, an event gets logged. I am sure if you have something else initiating the shutdown that there will be event logs indicating that it is going down.

    Get-EventLog system -Newest 20 -Source User32
    

    Running this on my machine lists several shutdown events from different processes.

    The process C:\WINDOWS\system32\winlogon.exe (computername) has initiated the 
    restart of computer COMPUTERNAME on behalf of user KEVMAR for the following 
    reason: No title for this reason could be found
    

    This would be a good starting point.

    A trick I use is to just run Shutdown /a and it will tell me if it stopped a shutdown.