You should also see it in the Security log. I can't remember the event ID, but the event details will say shutdown in it somewhere. Correlate the startup in the system log and then go back a few minutes in the security log. adam "Matthew Shrewsbury" <MShrewsbury@COSC To ANHOMES.com> <thin@xxxxxxxxxxxxx> Sent by: cc thin-bounce@freel ists.org Subject [THIN] Re: OT: Who shutdown Windows 2000 server? 01/26/2007 08:55 AM Please respond to thin@xxxxxxxxxxxx g I could only find the answer by logging into the server as the user in question and having them click on shutdown. It then shows what the last option was selected. Thankfully the administrator was helpful in this case. Matthew Shrewsbury Network Manager From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf Of Matthew Shrewsbury Sent: Friday, January 26, 2007 10:48 AM To: thin@xxxxxxxxxxxxx Subject: [THIN] OT: Who shutdown Windows 2000 server? Anyway to tell who shutdown a Windows 2000 server? I just looked through the event log but nothing appears obvious. Matthew Shrewsbury Network Manager SBC SITES ONLY GOOGLE SEARCH: http://www.F1U.com ************************************************ For Archives, RSS, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link: //www.freelists.org/list/thin ************************************************