Share via

When I shut down my computer, it logs event id 1074.

Anonymous
2012-08-18T06:56:26+00:00

original title: Shutdown event id 1074.

Hi,

I have enable shutdown event tracker in my Windows 7 HP x86 machine.

I have noticed in system event logs that there are event id 1074 sometime initiated by Explorer.exe and sometime by Winlogon.exe.

Will somebody please explain me,

What is the difference of these two shutdown initiators ? I mean when they initiate the shutdown process ?

How can I initiate that manually (for testing only) ?

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous
2012-10-04T14:54:37+00:00

Hi Guys,

Not many people looking or interested on that issue, however I think I have found an answer for that.

I did a little research and found:

  1. A graceful shutdown initiated by calling an API such as ExitWindowsEx() or InitiateSystemShutdown().
  2. For ExitWindowsEx(); CSRSS acting upon the calling process' behalf and simply sends a window message to a window owned by the WINLOGON.EXE process for the current session to simulate the interactive user choosing the equivalent action from the WINLOGON user interface. So in the case of ExitWindowsEx() being called to initiate a shutdown, a window message is sent to the WINLOGON process for that session, requesting a shutdown, and WINLOGON behaves from that point just as if shutdown had been requested via its user interface.

-- And that is the reason when we see shutdown initiated by Winlogon.exe.

Was this answer helpful?

0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2012-08-25T00:29:43+00:00

    This is not I am looking for however thank you for your initiation.

    I am asking that a manual planned shutdown/restart generates event 1074.

    Now, sometime the initiator is explorer.exe and sometime it is winlogon.exe.

    What is the difference of these two type of shutdown ?

    I mean after updating the machine and reboot it says update service has rebooted the machine, which is understandable. But a shutdown initiated by winlogon.exe is not very clear to me.

    Thank you.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2012-08-19T03:51:23+00:00

    Hi Kuntak K Basu,

    You may refer the article and check if it helps:

    On a computer running Windows Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2 an incorrect shutdown reason code written to SEL on user initiated shutdown

    You may also post your query in the TechNet forums for further assistance:

    Windows 7 Performance TechNet Forums

    Was this answer helpful?

    0 comments