Auditing server shutdowns

[Andy]

I have a Windows 2000 terminal server that is being
shutdown every night. The event logs and security logs do
not tell me who is doing this. How do I audit the shutdown
process and who starts it?

 

[Guest]

U may run secpol.msc and assing or refine rights for shutting down the system only to a restriced grp of users, u may also enable restrict shutdown only if logged on by modifying security options on shutdown. Hope this is usefu
JC

 

[Steven L Umbach]

Try enabling auditing of system events. Of course that would not help if someone is
plain shutting of the power. --- Steve

http://www.comptechdoc.org/os/windows/win2k/win2kauditing.html