PsShutdown. ( logging who sent the command to my system)

[tdrclan]

How do I tell what computer sent a PSshutdown command to my computer?

last night at 6:30 my machine shutdown.
the log shows the administrator account was used but no workstation id was listed.

is there a way to log where the psshutdown is coming from???

TIA
Tim

 

[tootiredtocare]

I'm not sure there is. As a test, I shutdown my second PC and reviewed the logs and while it listed which account executed the command, no PC was listed.

If there is firewall software installed on your PC and it's running, perhaps it logged something

 

[karlisi]

From here
Every time when you execute remote operation with PsShutdown, it installs and starts service on target PCs though an access to their Admin$ shares. Then PsShutdown sends command to service and once operation is complete, it stops and uninstall service.

I think, you should look for service creation and deletion. It works if you have user privilege auditing enabled, which by default is off on workstations.

===
Karlis
ECDL; MCSA

 

[tdrclan]

Thanks, I'll look at your suggestions.

 

[BadBigBen]

also take a look at your BIOS settings, some have a shutdown timer, and someone may have set it to play a trick on you...



Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[RonyAguilar]

If you go into Event Viewer try looking for an Event ID "4674" or "7035." I don't think it will tell you were the command came from exactly, but if you filter through the tabs you might get something.