aA computer in domain is randomly shut down by someone ( hehe was caught once ) !
heHe uses shutdown /s /f /t 0 /m \\computername
in windows command line to accomplish this.
afterAfter the incident some computers randomly shut down several times a week, but maybe not by the same person !.
nowNow the question: is: Is it possible to detect / monitor if a computer was shut down remotely, and by who ? ( egeg in Event Viewer )