The Enable Persistent Time Stamp policy must be enabled on the target servers to track the shutdowns.
While there are several methods to configure local policies, this guide covers just one of them: how to configure policies locally with the Local Group Policy Editor snap-in. To apply settings to the whole domain, use the Group Policy but consider the possible impact on your environment.
To enable the policy
- On the audited server, open the Local Group Policy Editor snap-in: navigate to Start → Run and type "gpedit.msc".
Navigate to Computer Configuration → Administrative Templates → System and locate the policy.
Policy Name State
Enable Persistent Time Stamp