Event ID 513 not logged at shutdown

From: John Doe (no.email@thanks)
Date: 02/20/03 

From: "John Doe" <no.email@thanks>
Date: Thu, 20 Feb 2003 07:23:44 -0800

Hi,

Running NT4SP6a
User Manager, Policies, Audit, Audit these events, checked
ALL boxes.

Shutdown the box.
Restarted.

Checked Security Log and cannot find event ID 513 for the
shutdown, although event ID 512 does show up indicating
the startup.

Checked Q299475 and Q174074.

I need to determine what user initiated the shutdown.

What did I miss?

Thanks!

John

Relevant Pages

  • Re: Event ID 513 not logged at shutdown
    ... not show up in reality on all OS builds... ... > User Manager, Policies, Audit, Audit these events, checked ... > shutdown, although event ID 512 does show up indicating ...
    (microsoft.public.win2000.security)
  • Re: System Audit
    ... Audit Policy is enabled in User Manager on NT4, ... To audit shutdown events, you need to enable the "System" audit category. ...
    (microsoft.public.win2000.security)
  • Re: How to audit WHO has shutdown a server?
    ... system has been shutdown, but I want to audit WHO has initiated a shutdown. ... This is not recorded in the eventlogs. ... MVP for Windows Server - Software Distribution ...
    (microsoft.public.security)
  • Re: How to Audit shutdown/restart event? pls advice..
    ... Shutdown and Restart are part of the "System" audit category. ... > Default Domain Policy and the Default Domain Controllers Policy (you need ... >> this is a 2000 member terminal server on the network.I ...
    (microsoft.public.win2000.security)
  • Re: NT4 Question
    ... >> Presuming you have a domain, enable auditing for this. ... > User Manager, policies, audit ...
    (microsoft.public.windows.server.general)
Quantcast