Windows Server 2003 and 2008 have the Shutdown Event Tracker, which seems useful in theory to track why a machine was shutdown.
But in reality, I found that most IT Teams have a whole change process anyway thay defines which servers are going to be rebooted/shutdown when and why, and in case of unexpected shutdowns they log a more elaborate post mortem anyway.
I think I only ever found it useful when working late on RDP and accidentally hitting Shut Down instead of Log Off, an error that is easy to make in Windows 2003.
But I'm just wondering, is there any real-world use to it that is not already tracked through the usual IT monitoring/planning procedures?