Need event monitor to determine how the PC was shutdown.

I'm having some problems with a networked PC here at work. It hosts programs for various machines. The operators out at the machine will call the program up from the host pc. Problem that is happing is the PC is somehow getting logged off or restarted during the night or sometime early in the morning and then the operators cannot load programs until someone from our group gets in to log the system back on. Is there a way in events log to determine how the computer was shutoff or logged out or is there some software that will tell me this? The OS is Windows XP. Ideally it'd be able to distinguish between:

• Shutdown or Restart using Ctrl+Alt+Delete

• Shutdown or Restart using the Start menu

• Shutdown or Restart using the Logon screen

• Shutdown or Restart using the power button

Or something like that. I need to find out how the machine is getting logged off. Any ideas are appreciated.

First check and see if automatic updates are on... Sometimes it will update and need a restart and it will automatically do it
Is this happening every night/morning?

Check this out... http://support.microsoft.com/kb/308427/

As for showing the methods, you can't really tell from the logs whether it was from start menu or ctrl-alt-del, but you can often tell if it was shut down in a friendly manner(menu/logon screen) or killed via the power button. If you look in the system event log for the "Service Control Manager" entries you should see entries saying "XxXX service has entered the stopped state. If so then the computer was shutdown(or rebooted) in a windows friendly way. Note that these are then followed by 'xxx entered the running state" as the computer/windows comes back online if it was rebooted. If all you see are "xxxxx service has entered the running state" then that means it likely wasnt shutdown properly(since the services were not stopped). I also beleive that the update service actually writes event log entries when it does its thing like 6ghztofreedom mentioned.