Windows NT is shutting down.
All logon sessions will be terminated by this shutdown.
Despite the documentation's wording,
neither Windows 2000 nor Windows NT logs event 513.
Event 513 is an
important security event: Any operating system is
defenseless while it's down. You should document system shutdowns in a written log that monitors who shut down which system and for how long. You can determine the duration
of a system shutdown by checking for
a previous event 512 for the system. If no event 512 appears, look for the most recent event 517.
