Event ID 6009: is this event triggered only when a user-initiated shutdown has occurred?

Event 6009 is logged at startup, not at shutdown. It contains only a string identifying the operating system version. It's been that way since NT 4.0 or so.

If you're looking for a system initiated shutdown/restart, look for event 1074. The details for this event will tell you what process initiated the restart and what reason was given, and you can check the reason code for further information about why the system shut down or restarted.

Tags:

Windows Server 2003

Windows Server 2008

Windows Event Log

Related

Converting UTF-8 NFD filenames to UTF-8 NFC, in either rsync or afpd Restrict user from saving on their Desktop, My Documents, My Music, My Videos, My Pictures etc. via GPO Configure DNS server to return same IP for all domains Your system administrator does not allow the use of saved credentials to log on to the remote computer How to restrict mailman list subscriptions to certain domains? Nginx proxy domain to another domain with no change URL How to forward specific log file outside of /var/log with rsyslog to remote server? Is there a way to determine which virtual interface belongs to a virtual machine in a kvm host? S3fs performance improvements or alternative? IIS gives wrong certificate for an HTTPS request How can the little guys effectively learn and use Puppet? Microsoft Windows - Install Updates And Restart (instead of Install and Shutdown)

Recent Posts