Windows Security Log Event ID 513

513: Windows is shutting down

On this page

• Description of this event
• Field level details
• Examples

Despite the documentation's wording, "Windows NT is shutting down", neither Windows 2000 nor Windows NT logs event 513.  Windows Server 2003 does log this event.

Event 513 is an important security event: Any operating system is defenseless while it's down. You should document system shutdowns in a written log that monitors who shut down which system and for how long. You can determine the duration of a system shutdown by checking for a previous event 512 for the system. If no event 512 appears, look for the most recent event 517.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Supercharger Free Edition

Your entire Windows Event Collection environment on a single pane of glass.

Free.

 

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy