Note: Clicking on a photo will enlarge it.
Login to a client device. Press the Windows + R keys to open the Run dialog, type eventvwr.msc, and press Enter.
If prompted by UAC, then click on Yes (Windows 7/8/10) or Continue (Vista).
In the left pane of Event Viewer, double click on Windows Logs to expand it, click on System to select it, then right click on System, and click on Filter Current Log.
Standard Shutdown Events
Click on the drop down arrow to the right of Event Sources, check the USER32 box.
In the Includes/Excludes feild, type: 1074, then click on OK.
This will give you a list of power off (shutdown) and restart Shutdown Type of events at the top of the middle pane in Event Viewer.
You can scroll through these listed events to find the events with power off as the Shutdown Type. You will notice the date and time, and what process was responsible for shutting down the computer per power off event listed.
You can see in this example highlighted that vulscan called the reboot. If Endpoint Manager calls a reboot this is typically what you will see. Any other process that calls a reboot is not being controlled by Ivanti.
To See the Dates and Times of All Unexpected Shut Downs of the Computer
These are typically crashes, while the information might not be complete, it can be useful to troubleshooting unexpected shutdowns.
Click on the drop down arrow to the right of Event Sources, check the USER32 box.
In the Includes/Excludes field, type: 6008, then click on OK.
This will give you a list of unexpected shutdown events at the top of the middle pane in Event Viewer. You can scroll through these listed events to see the date and time of each one.
When finished, you can close Event Viewer.