Troubleshooting Shutdown Event Tracker

Article
10/08/2009

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Troubleshooting

What problem are you having?

Shutdown Event Tracker does not appear when you attempt to shut down your computer. (The standard Windows shutdown dialog box appears. It does not allow you to supply a reason or a comment.)
A System State Data file is not created before an unplanned shutdown: Upon checking the Event Log for the corresponding 1074 event, you see that the System State Data file name does not appear in the event description.
You initiated the shutdown sequence using the command line, but the shutdown reason text in the event description is incorrect.
When you log on to a computer, the error reporting dialog box appears even though the previous shutdown was planned.
The OK button is disabled after you choose a shutdown reason.
After you upgrade a server from Windows NT to a Windows Server 2003 family operating system, users who were previously able to shut down the computer can no longer do so.
When you attempt to shut down a remote computer, you are denied access.
The Shutdown tool (Shutdown.exe) fails to restart or shut down a remote computer, although the target computer is functioning properly.

Shutdown Event Tracker does not appear when you attempt to shut down your computer. (The standard Windows shutdown dialog box appears. It does not allow you to supply a reason or a comment.)

Cause: Shutdown Event Tracker is disabled.

Solution: If you have not yet enabled Shutdown Event Tracker using Group Policy, do so.

Cause: You do not have the rights to shut down the computer.

Solution: Assign yourself the rights to shut down each computer that you manage or have your system administrator assign you the appropriate user rights.

See also: Privileges and Security overview

Cause: An out-of-date shutdown tool from an earlier Resource Kit is installed.

Solution: Uninstall any out-of-date shutdown tool.

Cause: The Shutdown Event Tracker Group Policy setting has not yet taken effect.

Solution: Allow more time for the Group Policy setting to update itself. If this strategy does not yield results, use the gpupdate.exe tool.

See also: Group Policy (pre-GPMC) and Gpupdate.

Cause: A higher-level Group Policy configuration takes precedence.

Solution: If the Group Policy settings are at a higher level and you do not have the proper administrative credentials to change it, contact your system administrator.

See also: Windows Server 2003 Technical Reference at the Microsoft Web site, Group Policy (pre-GPMC), and Configure Shutdown Event Tracker on a domain or organizational unit.

A System State Data file is not created before an unplanned shutdown: Upon checking the Event Log for the corresponding 1074 event, you see that the System State Data file name does not appear in the event description.

Cause: The System State Data feature is disabled.

Solution: If you have not yet enabled the System State Data feature using Group Policy, do so. If the problem persists, consult the Microsoft Resource Kit chapter, below.

Cause: You initiated the shutdown on a computer running Windows XP Professional.

Solution: Windows XP Professional does not include the System State Data feature.

You initiated the shutdown sequence using the command line, but the shutdown reason text in the event description is incorrect.

Cause: The appropriate reason code was not defined on the computer you shut down.

Solution: Add the same set of reasons to all the computers in your organization.

See also: "Tools for Troubleshooting" at the Microsoft Windows Resource Kits Web site.

When you log on to a computer, the error reporting dialog box appears even though the previous shutdown was planned.

Cause: The person who performed the previous shutdown specified it as unplanned. This is likely if the shutdown was initiated from the command line, because omitting p: causes Shutdown Event Tracker to record an unplanned event.

Solution: You cannot use Shutdown Event Tracker to change or annotate the details of an unplanned shutdown that was expected by the computer, after the fact. In other words, the user who initiated the shutdown did so through the Shutdown Event Tracker user interface (UI) or the command line instead of pulling the power cord or pushing the power button. If the unplanned shutdown was initiated through a different tool, contact that vendor to see if an updated version exists, and whether it supports planned and unplanned shutdown flagging.

The OK button is disabled after you choose a shutdown reason.

Cause: A comment is required for this reason.

Solution: Type explanatory text in the Comment box.

After you upgrade a server from Windows NT to a Windows Server 2003 family operating system, users who were previously able to shut down the computer can no longer do so.

Cause: The shutdown user rights assigned to users on Windows NT systems will be automatically revoked during an upgrade to a Windows Server 2003 family operating system. This is done for security purposes, to ensure that user rights are uniformly assigned.

Solution: Use group accounts in Active Directory to ensure that shutdown user rights are uniformly assigned to trusted users.

When you attempt to shut down a remote computer, you are denied access.

Cause: You must have the appropriate user rights on the remote computer before you attempt to shut it down.

Solution: Establish the appropriate user rights on all computers that you must remotely manage. Being able to shut down a computer locally does not mean that you have the right to shut it down remotely.

The Shutdown tool (Shutdown.exe) fails to restart or shut down a remote computer, although the target computer is functioning properly.

Cause: There are four possible causes:

The target computer has just restarted and is applying policies.
A shut down of the target computer is in progress or has already occurred.
The log on dialog box is open on the target computer.
An expected or unexpected shutdown dialog box is open on the target computer.

Solution: In all of these cases, the operating system is functioning properly. For the last two causes, wait for a few minutes before making another attempt to restart or shut down the target computer.

Share via

Troubleshooting Shutdown Event Tracker