SOLVED: How To Determine Who Shutdown or Logged Off a Windows Computer
If you are an administrator, or even just a curious power user, there will come a time when you will want to know who shutdown a computer, or who logged off of a computer last.
How To Tell Who Shutdown a Windows Computer
Launch the EVENT VIEWER
Expand WINDOWS LOGS
Expand SYSTEM
Click FILTER CURRENT LOG (in the Actions pane, on the right)
Enter 1074 (for SHUTDOWN) in the EVENT ID field, and click OK
Click on the entry that is closest to the date/time you are interested in
Note the user name
Note the reason that user gave for the shutdown
If you want to know who logged off of a machine, on step 5 you set the EVENT ID to 4647 and also 4637
