Windows shutdown command. The event ID's below will show you these details.