i`m trying to trace a remote shutdown in a domain network. i wanto to know which computer send the remote shutdown. i saw in the windows events and i just found the user who send remote shutdown.

Hi, Based on my research, we can only trace which user sent the command. You could see the information about shutdown in Event log: Shutdown Event Tracker Hope it helps. Alex ZhaoPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.