Windows logon event tracker

Teams Walkie-Talkie. PCI Express 6. Use Your iPhone as a Webcam. Hide Private Photos on iPhone. All Microsoft's PowerToys for Windows.

Take Screenshot by Tapping Back of iPhone. Windows 11 Default Browser. Browse All Windows Articles. Windows 10 Annual Updates.

OneDrive Windows 7 and 8. Copy and Paste Between Android and Windows. Protect Windows 10 From Internet Explorer. Mozilla Fights Double Standard. Connect to a Hidden Wi-Fi Network. Change the Size of the Touch Keyboard. Reader Favorites Take Screenshot on Windows. Security, Compliance and Identity. Microsoft Edge Insider.

Azure Databases. Autonomous Systems. Education Sector. Microsoft Localization. Microsoft PnP. Healthcare and Life Sciences. Internet of Things IoT. Enabling Remote Work. Small and Medium Business. Connect and share knowledge within a single location that is structured and easy to search.

Since that time, on each login to the server via RDP the Shutdown Event Tracker shows asking for information about an unexpected shutdown. Checking the Event Viewer there is no evidence of a restart, unexpected or otherwise, since the previous time I'd seen this message previously and filled it out. How do I stop this from showing each logon or clear whatever is stuck in the system that is triggering it? The server is up to date on patches, serving files without much of any additional software except for the Splunk UniversalForwarder mandated by HQ.

In research of this issue I've found it has been reported occurring on Server and Removing two registry keys appears to resolve the issue. To resolve I opened the Registry using an account with admin privileges on the server, and navigated to and deleted the two following registry keys after backing up, of course :.

After removing these two registry keys the Shutdown Event Tracker did not show up on subsequent logins. Sign up to join this community. Auditing and tracking Windows activities to identify suspicious activity is paramount for numerous reasons, including:.

You should have a robust security monitoring process in place to see who is logging onto your server and when. This will identify suspicious events in the Windows server security reports. As the administrator of a server, there are several events to keep an eye on to protect your network from nefarious Windows user activity, including:. As discussed above, events are recorded in the event log in Windows.

The three main types of native logs are:. XpoLog7 is an automated log management tool to provide:. The basic plan is free forever for 0. For those needing more features, Xpolog7 also offers several tiered pricing options.