SOLVED: How To Determine Who Shutdown or Logged Off a Windows Computer

If you are an administrator, or even just a curious power user, there will come a time when you will want to know who shutdown a computer, or who logged off of a computer last.

How To Tell Who Shutdown a Windows Computer

1. Launch the EVENT VIEWER
2. Expand WINDOWS LOGS
3. Expand SYSTEM
4. Click FILTER CURRENT LOG (in the Actions pane, on the right)
5. Enter 1074 (for SHUTDOWN) in the EVENT ID field, and click OK
6. Click on the entry that is closest to the date/time you are interested in
7. Note the user name
8. Note the reason that user gave for the shutdown

If you want to know who logged off of a machine, on step 5 you set the EVENT ID to 4647 and also 4637