shutdown script

[idotoro]

hi,
i configure a simple shutdown script with group polict that send the %username% and %computername% to a network file.
that way i can know who did shutdowns .
but the problem is that the shutdown script run after the network connection is closed so he can't run
someone have an idea howo to bypass this problem ?

[Ivan Ferreira]

Have you tried configuring it as a "logoff scripot" instead of a shutdown script?

[KJPowers]

If you're using W2k3 Server (I haven't tested it on other versions but it's likely the same), look for event ID 1074 in the Event Log. It gives this for information:

"Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 2/5/2007
Time: 4:40:56 PM
User: OFFICE\Administrator
Computer: PETRA
Description:
The process Explorer.EXE has initiated the restart of computer PETRA on behalf of user OFFICE\Administrator for the following reason: Other (Planned)
Reason Code: 0x85000000
Shutdown Type: restart
Comment: test

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp .
Data:
0000: 00 00 00 85 ... "