audting Windows server shutdowns

[cabetcove]

Hi,
does anyone know how I can audit the shutdown of Windows servers ?
I cannot find any shutdown by xxx user id event's.

I have searched the net but cannot find anything.
I would assume it's an audit function as it would be
quite usefull to see who shut's down a server.
Thanks for your help.

Thanks

Thorsten

 

[adcfaq]

The events are automatically generated in the system log: Eventlog events
6005-6009.

gpedit.msc---->Computer\Windows Settings\Security Settings\Local Policies\Audit Policy--->audit system succ and fail.