|Product:||Windows Operating System|
|Message:||The reason supplied by user %6 for the last unexpected shutdown of this computer is: %1
Reason Code: %2
Bug ID: %3
Bugcheck String: %4
This event refers to the failure indicated by the previous EventLog 6008 event. The User32 1076 event is written when the first user with shutdown privileges logs on to the computer after an unexpected restart or shutdown and supplies a reason for the occurrence. An unexpected restart or shutdown is one that the system cannot anticipate, such as when the user pushes the computer’s reset button or unplugs the power cord.
A member of the Administrators security group can also log the reason for a remote computer’s unexpected restart or shutdown using the Shutdown.exe tool. If many remote computers are unexpectedly shut down, as in the case of a power outage, Shutdown.exe provides a way for the administrator to remotely log the same shutdown reason on all the affected computers.
The User32 1076 event is written to the system log only when the Shutdown Event Tracker group policy setting is enabled or not configured on a computer running a Windows Server 2003 operating system. For more information about Shutdown Event Tracker group policy settings, see Help and Support.
No user action is required.