Windows Security Log Event ID 513

513: Windows is shutting down

On this page

• Description of this event
• Field level details
• Examples

Despite the documentation's wording, "Windows NT is shutting down", neither Windows 2000 nor Windows NT logs event 513.  Windows Server 2003 does log this event.

Event 513 is an important security event: Any operating system is defenseless while it's down. You should document system shutdowns in a written log that monitors who shut down which system and for how long. You can determine the duration of a system shutdown by checking for a previous event 512 for the system. If no event 512 appears, look for the most recent event 517.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Supercharger Enterprise

 

 

Upcoming Webinars The Changing Landscape of Authentication and Logon Tracking in Hybrid Environments of Entra and AD Understanding REST APIs and Their Security Issues: Secrets, Input Validation, Output Filtering, Call Limits, Automation, Authorization

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy