detect shutdown timer event.

Question

Hi,

my name is Toni. i am an IT system. inside the company the attendance of the employees is based on active directory sign-in and sign-out (we can use shut down also of the PC), integrated with people 365. we notice that some users left early but on the system the checkout is on the right time. i mean the standard time to left the work is 4:00 PM, some users left at 3:30 PM but on the attendance schedule the time is 4:00 PM. i am afraid that they are running a shutdown timer on their PC to shutdown after 30 min.

my question is : how to stop this? and how to detect the computer name inside the environment running a shutdown timer on the PC
environment PCs: windows 10
many thanks.

Answer 1

Hello there,

You can simply track this with the help of Event ID 1074: The system has been shut down by a process/user.

This event is written when an application causes the system to restart, or when the user initiates a restart or shutdown by clicking Start or pressing CTRL+ALT+DELETE and then clicking Shut Down.

You can create a simple Powershell script that can identify this Event ID and then trigger a mail. You can also add the time to the script so it can monitor the shutdown up to 4:00 PM.

---------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–