An incorrect shutdown reason code written to SEL on user initiated shutdown
This article provides a resolution for the issue that an incorrect shutdown reason code written to SEL on user initiated shutdown.
Applies to: Windows Server 2012 R2, Windows 7 Service Pack 1
Original KB number: 2001061
After reboot from a manual shutdown (
Shutdown), the Windows System Eventlog shows two events 1074. The first entry contains the correct reason code provided by the user, the second looks similar to:
Log Name: System
Event ID: 1074
Task Category: None
The process C:\Windows\system32\winlogon.exe <computername> has initiated the power off of computer <computername> on behalf of user <computername>\Administrator for the following reason: No title for this reason could be found
Reason Code: 0x500ff
Shutdown Type: power off
Event 0x000500FF (System Failure) is written to the SEL (System Event Log) even if a different shutdown reason was provided by the user who initiated the shutdown.
Microsoft has confirmed that this is a problem.
Microsoft will address the problem in future releases.
Use shutdown.exe to initiate the shutdown, run below command (for example) from the elevated command line:
shutdown.exe /r /d P:4:2
This will result in an event log and SEL entry with reason code 0x80040002.
Shutdown reason codes can be found here: https://msdn.microsoft.com/library/aa376885(VS.85).aspx