That's why I like to take the shutdown command off of the start menu and leave only the Logoff button. If an administrator really wants to shutdown/restart a computer, he or she will have to select Start->Run and type in Shutdown /r (or something similar) Joe _____ From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf Of PETERSON, DAVID Sent: Friday, March 25, 2005 4:55 PM To: thin@xxxxxxxxxxxxx Subject: [THIN] Logging which user shut server down My Citrix server went down today, and when I got there it was powered off. It looks like a graceful shutdown. My security logs show a few admins logged in that have shutdown rights, but can't tell if any of them did it. Is there a way to determine which user initiated the shutdown? If not for this instance to catch the info if it ever happens again? NOTICE: This electronic mail transmission from the law firm of Dinsmore & Shohl may constitute an attorney-client communication that is privileged at law. It is not intended for transmission to, or receipt by, any unauthorized persons. If you have received this electronic mail transmission in error, please delete it from your system without copying it, and notify the sender by reply e-mail, so that our address record can be corrected.