Windows Server 2003 has added a feature, called the Shutdown Event Tracker tool, that can be useful to you should your server crash. The Shutdown Event Tracker is also useful for diagnosing the state of your server at the time of shutdown, to determine both the events occurring as services are turned off, and perhaps more importantly, their sequence.
At shutdown, Windows Server 2003 prompts you in a dialog box (it is not a command line tool) for the reason(s) that the server is being shutdown. This information is written to a log, along with the events that follow. You can use the Shutdown Event Tracker for either local or remote shutdowns. You see the events recorded in the System log, which is opened and viewable in the Event Viewer application for viewing at a later time.
You'll have to enable the Shutdown Event Tracker by turning it on in the Registry. At the Run dialog box, ender regedit and then navigate to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliabilty registry subkey. Enter a REG_DWORD entry called ShutdownReasonUI if required, and enable this feature by making that key's value as 1. To disable logging, you would set the key's value to 0.
Barrie Sosinsky is president of consulting company Sosinsky and Associates (Medfield MA). He has written extensively on a variety of computer topics. His company specializes in custom software (database and Web related), training and technical documentation.