Windows Server OS come with a security feature, Shutdown Event Tracker, which pop ups every time a server is initiated for shutdown or restart. This is required for auditing purpose to track the reason for server reboot or shutdown.
The same feature can be enabled for your Windows machine ( XP, Vista or Windows 7 ). This screen cannot be bypassed and record is stored with link to account which initiated the shutdown or reboot process.
- Launch the Group Policy Editor ( gpedit.msc in your run window )
- Navigate to Local Computer Policy > Computer Configuration > Administrative Templates > System
- Look for configuration item which says Display Shutdown Event Tracker, Enable it.
- Now here you can set this option to work for only workstation or normal PC by selecting it from the drop down. For server machines starting from Windows Server 2003 its enabled by default.
The only drawback of this process is you can choose others in the Shutdown tracker and add any random text and submit.
Related : How to prevent users from shutting down or restarting Windows 7, XP and Vista
