Event ID - 513

Event Id513
DescriptionWindows NT is shutting down. All logon sessions will be terminated by this shutdown.
Event InformationAccording to Microsoft :
Cause :
The Event Log service, on behalf of the Local Security Authority, logs this event when it is notified that Windows is shutting down.
Resolution :
No user action is required.


This event record indicates that the system is being shut down in an orderly fashion. This is not a guarantee that the system successfully shut down before power was turned off or the system stopped, because once the system has shut down it cannot write the fact that it has shut down to the log.
Reference LinksEvent ID 513 from Source Security

The Security Monitoring and Attack Detection Planning Guide

Alternate Event ID in Vista and Windows Server 2008 is 4609.

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught

Did this information help you to resolve the problem?

Yes: My problem was resolved.
No: The information was not helpful / Partially helpful.