You can document the reason for an unexpected restart or shutdown of a remote computer without logging on locally to that computer. In order to use this feature, the Remote Registry service must be enabled on the remote computer. See Enable the Remote Registry Service for more information.

Membership in the Administrators group, or equivalent, on the remote computer is the minimum required to complete this procedure.

Using the Windows interface

To document the reason for an unexpected restart or shutdown of a remote computer using the Windows interface

  1. Open Command Prompt.

  2. Type shutdown /i to display the Remote Shutdown dialog box (Shutdown.exe).

  3. Under Computers, click Add to enter computer names, or click Browse to open the Find Computers dialog box.

  4. Under What do you want these computers to do, click Annotate Unexpected Shutdown.

  5. Select the appropriate reason for the unexpected shutdown from the list.

    Note

    If a comment is required, the OK button will not be available until you type at least one character in the text box.

Additional considerations

  • To start Command Prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  • Another way to start Command Prompt is to click Start, click in the Start Search box, type cmd, and press ENTER.

  • The Remote Registry service must be enabled on the remote computer for Shutdown Event Tracker to record information.

  • To shut down or restart a remote computer, the Remote Administration and Windows Management Instrumentation firewall exceptions must be enabled on the remote computer.

Additional references

Using a command line

Membership in the local Administrators group, or equivalent, on the remote computer is the minimum required to complete this procedure.

To document the reason for an unexpected restart or shutdown of a remote computer using the command line

  1. Click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type shutdown /e /m \\ComputerName /c "Comment" /d [u|p] <xx>:<yy> and then press ENTER.

Value Description

/e

Enables you to document the reason for the unexpected shutdown on the remote computer.

/m \\ComputerName

Specifies the destination computer.

/c

Enables you to comment in detail about the reason for the shutdown. You can use a maximum of 511 characters. Comments must be enclosed in quotation marks.

/d [u|p] xx:yy

Lists the reason for the system restart or shutdown, where xx specifies a major reason number from 0 through 255, and yy specifies a minor reason number from 0 through 65,535.

/force

Forces the computer to shut down if other users are logged in. If this is not used and other users are logged in to the remote computer, the computer will not shut down or restart.

Important

If you force the computer to shut down or restart, logged in users will not have the opportunity to save their work.

/t xxx

Sets the time-out period before the system shuts down or restarts to xxx seconds. The valid range is 0-600, with a default of 30. Using the /t flag implies the /force option.

For more detailed information about the shutdown command and additional options, type shutdown /? at the command prompt.

Additional considerations

  • The Remote Registry service must be enabled on the remote computer for Shutdown Event Tracker to record information.

  • To shut down or restart a remote computer, the Remote Administration and Windows Management Instrumentation firewall exceptions must be enabled on the remote computer.

Additional references

  • Document the Reason for an Unexpected Restart or Shutdown of the Local Computer
  • Enable the Remote Registry Service