Re: Event ID 513 not logged at shutdown

From: Rainer Gerhards (rgerhards@adiscon.com)
Date: 02/21/03 

From: "Rainer Gerhards" <rgerhards@adiscon.com>
Date: Fri, 21 Feb 2003 10:00:11 +0100

Hi,

I am not sure if that is totally correct, but I remeber that 513 simply does
not show up in reality on all OS builds...

Rainer Gerhards
http://www.monitorware.com

"John Doe" <no.email@thanks> schrieb im Newsbeitrag
news:036301c2d8f4$0e41d350$3001280a@phx.gbl...
> Hi,
>
> Running NT4SP6a
> User Manager, Policies, Audit, Audit these events, checked
> ALL boxes.
>
> Shutdown the box.
> Restarted.
>
> Checked Security Log and cannot find event ID 513 for the
> shutdown, although event ID 512 does show up indicating
> the startup.
>
> Checked Q299475 and Q174074.
>
> I need to determine what user initiated the shutdown.
>
> What did I miss?
>
> Thanks!
>
> John

Relevant Pages

  • Event ID 513 not logged at shutdown
    ... User Manager, Policies, Audit, Audit these events, checked ... Shutdown the box. ... Checked Security Log and cannot find event ID 513 for the ...
    (microsoft.public.win2000.security)
  • Re: System Audit
    ... Audit Policy is enabled in User Manager on NT4, ... To audit shutdown events, you need to enable the "System" audit category. ...
    (microsoft.public.win2000.security)
  • Re: ClearVirtual Mem PgFile Shutdown
    ... Enabling this requires overwrite/scrubbing during the shutdown ... The reality is that to make use of the pagefile one must have ... Windows Settings ...
    (microsoft.public.windows.server.active_directory)
  • Re: How to audit WHO has shutdown a server?
    ... system has been shutdown, but I want to audit WHO has initiated a shutdown. ... This is not recorded in the eventlogs. ... MVP for Windows Server - Software Distribution ...
    (microsoft.public.security)
  • Re: How to Audit shutdown/restart event? pls advice..
    ... Shutdown and Restart are part of the "System" audit category. ... > Default Domain Policy and the Default Domain Controllers Policy (you need ... >> this is a 2000 member terminal server on the network.I ...
    (microsoft.public.win2000.security)