Basisc über Eventlogs und Meldungen,

http://technet.microsoft.com/en-us/library/bb742446.aspx

Startup Event
Windows 2000 records startup events in the System Event Log, as shown below. The Event Log service itself is the source of this event, and the Event ID is 6005. The time of this event is approximately the time the operating system becomes available to applications.

Clean Shutdown Event
Windows 2000 records a new event whenever an operating system shutdown is initiated. A clean shutdown can be initiated through several mechanisms.

Direct user interaction using a Shutdown screen as follows:
Shutdown or Restart using Ctrl+Alt+Delete
Shutdown or Restart using the Start menu
Shutdown or Restart using the Logon screen

Etc. …