Windows XP includes a new feature called the Shutdown Event Tracker, which you can use to record in the System log events related to intentional and unintentional shutdowns and restarts. To enable logging, go to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliabilty registry subkey. Create a REG_DWORD entry named ShutdownReasonUI if it doesn't already exist. Set the entry's value to 1. To disable logging, set the value to 0.
—Emmett Dulaney
edulaney@technicalcontent.com