When I turned off my computer, it logs the event id 1074.

original title: Shutdown 1074 event id.

Hello

I have enable event monitor in my Windows 7 HP x 86 machine.
In the system event logs, I noticed that there are event id 1074 formerly initiated by Explorer.exe and sometimes by Winlogon.exe.
Will someone please explain to me,.
What is the difference of these initiators of two stop? I mean when they start the shutdown process?
How can I run that manually (for testing only)?

Hi guys,.

Not a lot of people in the research or interested in this subject, however I think I found an answer for this.

I did a little research and found:

1. a stop initiated by the call to an API such as ExitWindowsEx() or InitiateSystemShutdown().

2. for ExitWindowsEx(); CSRSS acting on behalf of the calling process and simply to send a window message to a window owned by the WINLOGON. EXE process for the current session to simulate the interactive user, choosing the equivalent action in the WINLOGON user interface. So in the case of ExitWindowsEx() being called to initialize a stop, a message window is sent to the WINLOGON process for this session, which requires a stop and WINLOGON behaves that point everything as if the stop was requested through its user interface.

- And this is the reason why, when we see stop triggered by Winlogon.exe.

Tags: Windows

Similar Questions

Maybe you are looking for