Cause of an unprompted 4647 Logoff event at... Expand / Collapse
Author
Message
Posted 1/16/2012 9:56:21 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 1/16/2012 12:44:30 PM
Posts: 1, Visits: 5
My user wasprompted for a shut down time thinking this was a normal function of WindowsVista. Now he cannot cancel the event and I do not see anything in thescheduled tasks although I may have over looked it. The only thing I can findin the logs are events 4647 Logoff, followed three seconds later by a 4648Logon, but the computer still shuts down.
Post #894
Posted 2/20/2012 3:55:21 PM
Security Log Nerd

Security Log NerdSecurity Log NerdSecurity Log NerdSecurity Log NerdSecurity Log NerdSecurity Log NerdSecurity Log NerdSecurity Log Nerd

Group: Administrators
Last Login: 4/16/2009 1:11:51 PM
Posts: 49, Visits: 0
You could try enabling the process tracking category on the workstation to determine who and what program initiated the shutdown. In Vista the task may be shutdown.exe.
Post #924
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 9:58am