Windows Security Log Event ID 513
| Operating Systems |
Windows Server 2000
Windows 2003 and XP
|
|
Category | System |
|
Type
|
Success
|
Corresponding events
in Windows
2008
and Vista |
4609
|
513: Windows is shutting down
On this page
Despite the documentation's wording, "Windows NT is shutting down", neither Windows 2000 nor Windows NT logs event 513. Windows Server 2003 does log this event.
Event 513 is an important security event: Any operating system is defenseless while it's down. You should document system shutdowns in a written log that monitors who shut down which system and for how long. You can determine the duration of a system shutdown by checking for a previous event 512 for the system. If no event 512 appears, look for the most recent event 517.
Free Security Log Resources by Randy
Setup PowerShell Audit Log Forwarding in 4 Minutes