Searching for Windows shutdown messages in the event log
Posted by jpluimers on 2018/02/21
Searching for shutdown isn’t enough as frequent WAS messages also contain that search string.
Searching for shutdown of will work as they match both these:
The process C:\Windows\system32\shutdown.exe (COMPUTERNAME) has initiated the shutdown of computer COMPUTERNAME on behalf of user COUNTERS\Administrator for the following reason: No title for this reason could be found
Reason Code: 0x800000ff
Shutdown Type: shutdown
Comment:
and
The reason supplied by user DOMAIN\Username for the last unexpected shutdown of this computer is: Other (Unplanned)
Reason Code: 0xa000000
Problem ID: ######
Bugcheck String:
Comment: VM host failure
–jeroen
The Wiert Corner - irregular stream of stuff 
Leave a Reply