Event ID 6009: is this event triggered only when a user-initiated shutdown has occurred?

Question

Like the title says. From what I've briefly read, 6009 occurs when CTRL-ALT-DEL or Start > Shutdown is initiated by a user. If a shutdown sequence is initiated by SYSTEM for example, would this event also be logged?

Answer 1

Event 6009 is logged at startup, not at shutdown. It contains only a string identifying the operating system version. It's been that way since NT 4.0 or so.

If you're looking for a system initiated shutdown/restart, look for event 1074. The details for this event will tell you what process initiated the restart and what reason was given, and you can check the reason code for further information about why the system shut down or restarted.

Answer 2

Thanks to Michael Hampton for clarifying that 6009 is on startup.

To answer the OP's question, is there a 6009 after a system initiated shutdown? Yes, it appears so. There is a 6009 once the computer starts up after a system shutdown. (System shutdowns are event id 1074, like Michael says).

Here's a nice powershell to display both of these events so you can see for yourself that 6009's follow 1074's:

Get-WinEvent -FilterHashtable @{LogName = "System"; Id = 1074, 6009; }