How to tell if a Windows server is in the act of shutting down

265 Views Asked by At

I'm working on Windows Server 2008. Is there a way to tell (via the command line) if a server is in the act of shutting down? I searched for this but have been unable to find a way.

1

There are 1 best solutions below

0
On BEST ANSWER

Your best bet would be to query the system event log. If someone runs the shutdown command, an event gets logged. I am sure if you have something else initiating the shutdown that there will be event logs indicating that it is going down.

Get-EventLog system -Newest 20 -Source User32

Running this on my machine lists several shutdown events from different processes.

The process C:\WINDOWS\system32\winlogon.exe (computername) has initiated the 
restart of computer COMPUTERNAME on behalf of user KEVMAR for the following 
reason: No title for this reason could be found

This would be a good starting point.

A trick I use is to just run Shutdown /a and it will tell me if it stopped a shutdown.