suppose a user shutdown the system in the network and how to identify who is that user? plz tell me

Enable auditing and you will see the Shutdown event ID in the event log.. Description of the Shutdown Event Tracker: http://support.microsoft.com/kb/293814 Santhosh Sivarajan | MCTS, MCSE (W2K3/W2K/NT4), MCSA (W2K3/W2K/MSG), CCNA, Network+ Houston, TX http://blogs.sivarajan.com/ http://publications.sivarajan.com/ This posting is provided "AS IS" with no warranties, and confers no rights.