Windows Security Log Event ID 513

Operating Systems Windows Server 2000
Windows 2003 and XP
Type Success
Corresponding events
in Windows 2008
and Vista

513: Windows is shutting down

On this page

Despite the documentation's wording, "Windows NT is shutting down", neither Windows 2000 nor Windows NT logs event 513.  Windows Server 2003 does log this event.

Event 513 is an important security event: Any operating system is defenseless while it's down. You should document system shutdowns in a written log that monitors who shut down which system and for how long. You can determine the duration of a system shutdown by checking for a previous event 512 for the system. If no event 512 appears, look for the most recent event 517.

Free Security Log Resources by Randy

Supercharger Free Edition

Supercharger's built-in Xpath filters leave the noise behind.



Examples of 513

Windows is shutting down. All logon sessions will be terminated by this shutdown.

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources