if it's just for windows as I think it is, then this is the wrong forum as this is just for C and C++

you might get something in the EventViewer Logs (eventvwr command from run)

recently I came to knew about this..dos command shutdown can be used for remote machine as well.

do they clear the commands also???