I took control of a new VM running Windows Server 2019 (Datacenter) recently. Since that time, on each login to the server (via RDP) the Shutdown Event Tracker shows asking for information about an unexpected shutdown.

Checking the Event Viewer there is no evidence of a restart, unexpected or otherwise, since the previous time I'd seen this message previously and filled it out.

How do I stop this from showing each logon or clear whatever is stuck in the system that is triggering it?

I don't want to NOT see this dialog when it is warranted, I just know it's not warranted in this case and want to know how to stop it from showing up on EVERY logon.

The server is up to date on patches, serving files without much of any additional software except for the Splunk UniversalForwarder mandated by HQ.

  • Apart from the annoyance, a more important issue caused by this this popup is, that it blocks the running of a group policy user logon script. – Gustav Apr 26 '20 at 11:07

In research of this issue I've found it has been reported occurring on Server 2016 and 2019. Removing two registry keys appears to resolve the issue.

To resolve I opened the Registry using an account with admin privileges on the server, and navigated to and deleted the two following registry keys (after backing up, of course):


After removing these two registry keys the Shutdown Event Tracker did not show up on subsequent logins.

  • This really helped me, thanks a million. – jiraiya Nov 13 '19 at 16:54
  • 1
    Just changing the value of the DirtyShutdown key from 1 to 0 also works. – jk7 Mar 10 '20 at 2:59
  • I hope you didn't really backup first – Brain2000 Nov 5 '20 at 21:38

Just change the value of \HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability .\DirtyShutdown to 0

  • But change the value of \HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability .\DirtyShutdown to 0 will disabled this features and is not right. – Edwin Arias May 22 '20 at 0:18
  • @EdwinArias Do you have a better idea? – Caltor Jun 11 '20 at 11:52
  • @EdwinArias Are you sure this disables the feature rather than just changing the current state? – Caltor Jun 11 '20 at 12:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.