Viewing Shutdown Event Tracker events

As you can see in the image above, the Description indicates the reason for the shutdown, the time, the user that initiated the shutdown, as well as the comment that was typed in the Comment box.

To view previous Shutdown Event Tracker event logs, go to the Event Viewer (Start > Programs > Administrative Tools > Event Viewer or Control Panel - Administrative Tools - Event Viewer) and under the System Log, search for Information Events with ID 1074 or 1076. Double click the event to bring up the Event Properties page.

Note:
1074 Events are logged when you manually shutdown the machine using the Event Tracker.
1076 Events are logged when the machine shuts down unexpectedly and the Event Tracker pops up when the Administrator (or first user with shutdown rights) logs on to the machine.