if it's just for windows as I think it is, then this is the wrong forum as this is just for C and C++
you might get something in the EventViewer Logs (eventvwr command from run)
recently I came to knew about this..dos command shutdown can be used for remote machine as well.
do they clear the commands also???