Event ID
Source
Category
Message
513
Security
Type: Success Audit Description: Windows NT is shutting down. All logon sessions will be terminated by this shutdown.
Applicable to Windows NT, Windows 2000, Windows XP, Windows 2003