The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,376 other followers

Searching for Windows shutdown messages in the event log

Posted by jpluimers on 2018/02/21

Searching for shutdown isn’t enough as frequent WAS messages also contain that search string.

Searching for shutdown of will work as they match both these:

The process C:\Windows\system32\shutdown.exe (COMPUTERNAME) has initiated the shutdown of computer COMPUTERNAME on behalf of user COUNTERS\Administrator for the following reason: No title for this reason could be found
Reason Code: 0x800000ff
Shutdown Type: shutdown
Comment: 

and

The reason supplied by user DOMAIN\Username for the last unexpected shutdown of this computer is: Other (Unplanned)
Reason Code: 0xa000000
Problem ID: ######
Bugcheck String:
Comment: VM host failure

–jeroen

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

 
%d bloggers like this: