After reboot from a manual shutdown (START->Shutdown) the Windows System Eventlog shows two events 1074. The first entry contains the correct reason code provided by the user, the second looks similar to this:
- Log Name: System
- Source: USER32
- Date: 7/29/2009 12:00:26 PM
- Event ID: 1074
- Task Category: None
- Level: Information
- Keywords: Classic
- User: Computername\Administrator
- Computer: Computername
- The process C:\Windows\system32\winlogon.exe <computername> has initiated the power off of computer <computername> on behalf of user <computername>\Administrator for the following reason: No title for this reason could be found
- Reason Code: 0x500ff
- Shutdown Type: power off
Event 0x000500FF (System Failure) is written to the SEL (System Event Log) even if a different shutdown reason was provided by the user who initiated the shutdown.
Microsoft will address the problem in future releases.
Use shutdown.exe to initiate the shutdown. E.g. from the elevated command line run:
shutdown.exe /r /d P:4:2
This will result in an eventlog and SEL entry with reason code 0x80040002.
Shutdown reason codes can be found here: http://msdn.microsoft.com/en-us/library/aa376885(VS.85).aspx