Windows Server 2003 - Shutdown Event Tracker

How to Turn off the Shutdown Event Tracker

By default, when ever you shutdown or reboot a Windows Server 2003, an Event Tracker dialog box appears. Many techies get annoyed with having to give a reason for every reboot.  Their irritation is that when you click restart you cannot just click OK, you have to type something in the Comments box. 

Incidentally, I have never seen anyone type anything sensible in the comment box, which is another reason to disable the Shutdown Event Tracker.

Topics for Shutdown Event Tracker

• Group Policy Method
• Registry Method
• Summary of Event Tracker

Introduction

Whenever I install a test Windows Server 2003 machine, one of my first tasks is to turn off this Event Tracking / Shutdown feature.

There are two methods of disabling the Shutdown Event Tracker, either you can configure a Group Policy (best), or edit the registry.

Group Policy Method to Disable Shutdown Event Tracker

My favourite method to disable the Shutdown Dialog box is through Group Policy.  This is an occasion where you need to pay attention to detail, there are at least three traps for the unwary.  The first trap is whether to apply the policy to the entire domain or just one OU (best in testing).  There is one more place that you could apply the setting and that is to the Domain Controllers Group Policy. 

Next, ask yourself this, would this policy be part of the Computer Configuration or the User configuration?  The answer is that Shutdown Event Tracker is a Computer Configuration.

Complete Group Policy path to disable Shutdown Event Tracker:

Default Domain Policy
    Computer Configuration
       Administrative Templates
           System
               Display Shutdown Event Tracker

Note 1: Make sure that you choose the correct setting, Display Shutdown Event Tracker.  (Avoid Activate Shutdown Event Tracking)

Note 2: Don't fall at the last hurdle, make sure that you disable Display Shutdown Event Tracker (Avoid the Enable box).

Note 3:  One more trick.  Go to the cmd prompt and type gpupdate /force.  The beauty of this technique is that you can test the settings without actually rebooting the Windows 2003 Server.

Registry Method to Disable Shutdown Event Tracker

I hear rumours that you can also hack the registry to change Disable Shutdown Event Tracker.  I have to confess that I could not get this official method to work.  When I read the information it appeared that ShutdownReasonUI is the critical DWORD.

Registry path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\

This is what Microsoft say: "Shutdown Event Tracker references the Group Policy key. If the Group Policy key is not present, then this key can be configured as '0' (off), or '1' (on)."

What worries me is this sentence.  "If the Group Policy key is not present and this key is invalid or missing, then Shutdown Event Tracker is off."

Peter Buelens writes with this insight:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Reliability]
"ShutdownReasonOn"=dword:00000000
0 = Disable
1 = Enable

Clearly I am missing something here.  I tried saving the registry, making the change to Shutdown Event Tracker, then saving the registry again.  Next, I examined the two registry files with Windiff. Nothing.  No significant difference.  Naturally there were time differences, and I could see the Group Policy sequence numbers updating, but nothing in the above HKLM \Reliability\ or anywhere nearby.  Puzzling.

Jason Murray kindly wrote in with the following enlightening information.

HKLM\Software\Policies\Microsoft\Windows NT\Reliability\SnapShot

Enabled the value is 1
Disabled the value is 0
Not Configured - No key at all

How did I find this setting?

Opened up the GPO editor
Enabled the settings
Ran gpupdate /force
Finally, I checked the output under Administrative Policies. It lists the registry location there.

Guy recommends: The SolarWinds ipMonitor

My attraction to ipMonitor is because it inhabits that zone of part work, part play; Guy just could not put the dashboard away.  This excellent performance monitor will get you started in the quest to remove bottlenecks on your network.  SolarWinds provides this fully-functioning product free for 21 days.  So download and install ipMonitor, then start scrutinizing your computers CPU, memory and disk performance.  You can also select from zillions more performance counters such as fan temperature and battery level. 

Installing ipMonitor is a breeze, but learn from gung-ho Guy's mistake and install SNMP on each computer that you wish to monitor.  What sealed my unreserved recommendation of SolarWinds is their support team, you will get expert help even when you are evaluating the ipMonitor.

Download SolarWinds ipMonitor (21 days eval)

Summary of Disabling Shutdown Event Tracker

The Group Policy provides an elegant solution to those who are annoyed by the Shutdown Event Tracker.  If you try this technique, pay attention to detail, there are several places where you could make a mistake. Unfortunately, I could not get the registry method to work.

See Also

● Shutdown Command  ● ADSI Edit   ● Replmon   ● NTDSutil    ● CopyRite

Home Copyright © 1999-2008 Computer Performance LTD All rights reserved

Please report a broken link, or an error.