Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Like the title says. From what I've briefly read, 6009 occurs when CTRL-ALT-DEL or Start > Shutdown is initiated by a user. If a shutdown sequence is initiated by SYSTEM for example, would this event also be logged?

share|improve this question
up vote 1 down vote accepted

Event 6009 is logged at startup, not at shutdown. It contains only a string identifying the operating system version. It's been that way since NT 4.0 or so.

If you're looking for a system initiated shutdown/restart, look for event 1074. The details for this event will tell you what process initiated the restart and what reason was given, and you can check the reason code for further information about why the system shut down or restarted.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.