topic shutdown script in Windows Server 2003

shutdown script

idotoro — Mon, 05 Feb 2007 06:29:04 GMT

hi,
i configure a simple shutdown script with group polict that send the %username% and %computername% to a network file.
that way i can know who did shutdowns .
but the problem is that the shutdown script run after the network connection is closed so he can't run
someone have an idea howo to bypass this problem ?

Re: shutdown script

Ivan Ferreira — Mon, 05 Feb 2007 08:42:04 GMT

Have you tried configuring it as a "logoff scripot" instead of a shutdown script?

Re: shutdown script

KJPowers — Mon, 05 Feb 2007 17:49:28 GMT

If you're using W2k3 Server (I haven't tested it on other versions but it's likely the same), look for event ID 1074 in the Event Log. It gives this for information:

"Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 2/5/2007
Time: 4:40:56 PM
User: OFFICE\Administrator
Computer: PETRA
Description:
The process Explorer.EXE has initiated the restart of computer PETRA on behalf of user OFFICE\Administrator for the following reason: Other (Planned)
Reason Code: 0x85000000
Shutdown Type: restart
Comment: test

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp .
Data:
0000: 00 00 00 85 ...Â "