Windows Security Log Event ID 4609

4609: Windows is shutting down

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

Despite the documentation, as of Release candidate 1 this event is not found. Perhaps this is because the event logging service stops first (event 1100). This is funny since the same problem used to happen in NT.  MS fixed it in 2000 and looks like they broke it again at least as of RC1. I haven't been able to produce this event. Have you? If so, please start a discussion (see above) and post a sample along with any comments you may have! Don't forget to sanitize any private information.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Supercharger Free Edition

Supercharger's built-in Xpath filters leave the noise behind.

Free.

 

Mini-Seminars Covering Event ID 4609 Unraveling the All New Windows Server 2008 Security Log and Audit Policy Microsoft Audit Collection Services: How Does It Stack Up as a Security Log Solution?

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy