On a computer running Windows Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2 an incorrect shutdown reason code written to SEL on user initiated shutdown


After reboot from a manual shutdown (START->Shutdown) the Windows System Eventlog shows two events 1074. The first entry contains the correct reason code provided by the user, the second looks similar to this:

Log Name:      System
Source:        USER32
Date:          7/29/2009 12:00:26 PM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:         Computername\Administrator
Computer:      Computername
The process C:\Windows\system32\winlogon.exe <computername> has initiated the power off of computer <computername> on behalf of user <computername>\Administrator for the following reason: No title for this reason could be found
Reason Code: 0x500ff
Shutdown Type: power off

Event 0x000500FF (System Failure) is written to the SEL (System Event Log) even if a different shutdown reason was provided by the user who initiated the shutdown.


Microsoft has confirmed that this is a problem.


Microsoft will address the problem in future releases.


Use shutdown.exe to initiate the shutdown. E.g. from the elevated command line run:

shutdown.exe /r /d P:4:2

This will result in an eventlog and SEL entry with reason code 0x80040002.

Shutdown reason codes can be found here:   http://msdn.microsoft.com/en-us/library/aa376885(VS.85).aspx


More Information

The SEL (System Event Log) is the database of events in thebaseboard management controller (BMC) hardware. TheSEL adapter conveys these events to the operating system.