Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1073 Source: USER32

The attempt to <action> <machine name> failed.
- Action: power off. In my case this happened when the power off button was pressed. The computer attempted to shut down Excel but I had a spreadsheet that was not saved and Excel was asking if the file should be saved. After I pressed "Cancel" to return to Excel, the shutdown was cancelled and this event was recorded. The same happened during an attempt to restart (but the action listed was "restart/shutdown").
I opened Task Manager and as no applications were running, I checked the processes. Acrobat.exe was listed although no applications were open. I ended the acrobat.exe process and I was again able to shut down as normal.
- Action: restart/shutdown - In my case, it was related to the LANDesk Remote Control service. I just restarted the service and the issue went away.
Windows XP Professional SP2 Dell Dimension machine would not shut down. A search at first indicated that it was a "know issue" with Norton Antivirus 2006 and that Symantec offered a fix. Rather than run a fix, I uninstalled Norton but the problem remained. A search of the Dell user forum indicated that this could be corrected by installing the "User Profile Hive Cleanup Service", a download from Microsoft. Once installed, the problem was fixed.
We use DELL Flat Panels with USB Hub inside. In my case, one USB Hub hang up and the System would not reboot or shut down. As per Dell:
1.Disconnect all cables from the Panel
2.Press the Power button for 10 seconds to unload all power.
3.Reconnect all Cables

The problem was solved.

- Action: restart/shutdown - From a newsgroup post: "It happened for me too when I was using Lavasoft's Ad-watch 3.0 (it came with Ad-aware 6.0), so I usually closed it before shutting down my computer. Check your running processes in Task Manager and try to find out if something (some process) blocks your shutdown/restart procedure when it is terminated".
- Action: restart/shutdown - In our case, the problem appears to have been caused by using a script to shutdown the servers without first disabling shutdown event tracking. We used the following steps to disable shutdown event tracking:
1. Go to Start -> Administrative Tools -> Group Policy Management.
2. Navigate to the Default Domain Controllers Policy. (Go to Forest -> <your forest> -> Domains -> <your domain> -> Domain Controllers -> Default Domain Controllers Policy).
3. Right-click the Default Domain Controllers Policy, and select Edit.
4. Go to Computer Configuration -> Administrative Templates -> System.
5. Double-click Disable Shutdown Event Tracker.
6. Select Disabled, and click OK.
7. Go to Start -> Run.
8. In the command prompt, enter gpupdate to refresh the group policy on the affected servers.
In our case, an old version of the ATI Radeon driver was the cause of this problem, specifically, the ATI2EVXX.exe file in the 7.9 generation driver package. We updated the driver with the latest ATI driver version and Remote Desktop logout/shutdown is back to normal.
In my particular case, an executable called Automatic.exe was being called every time someone logged into my XP Pro SP2 box. This belongs to Driver Cleaner Pro ( After killing it in the Task Manager, I am able to restart or log off normally. The longer-term work-around is to disable it using msconfig. I believe the executable is used solely for the Live Update feature.
- Action: restart/shutdown - We run Win2k3, PowerFuse 7.01a, and Citrix PS3 in combination with WI 3.0 and CSG 2.0. The WebInterface and CSG are running on the same machine and are in a DMZ. The Citrix servers are in the LAN. We published a RDP Client with Citrix/PowerFuse so we could manage all the servers. After a while, this event started to appear in the log. We noticed that it happened if we closed/disconnect the RDP client. After setting the RDP client's local resources setting to no local resources, the event went away.
As per MSW2KDB, this event is written when a user or application attempts, but fails, to restart or shut down the computer by using either the graphical user interface (GUI) or the shutdown command.

See ME324268 for information on how to troubleshoot shutdown problems in Windows Server 2003 and "Windows XP Shutdown & Restart Troubleshooting" for details on Windows XP.
- Action: "shutdown" - This only occurs when I try to reboot or shutdown my machine and I am running my RSS reader in the background as an item in my system tray. The RSS reader software is SharpReader v. which uses the .NET CLR 1.1.4322.573. If I exit SharpReader the reboot/shutdown process will complete successfully.
I was getting this error on a userís PC on the network, immediately prior to shutdown. The error I was getting was a W32Time error. I stopped the service for Windows Time and error went away.
Action: "power off" - Lavasoft Ad-watch is one possible cause. If you disable Ad-watch before log-off, you can log-off without error.

Action: "power off" - Some foreground process may prevent system shutdown. For example, movie player with optinons "Prevent appearing screen saver" or something like that, when you push "shutdown" button on keyboard.
Action: "unknown" - This only occurs when I try to logoff my user ID and I am running a backup software as a service. If I stop the service, I can log off.
Action: "log off user", "shutdown". PcAnywhere 10.5 host service is causing this problem on my computer. When I close the host service problem is gone.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.