A shutdown will be shown in the event log's jim, or you'll have an event log saying "the system was shutdown @ such and such a time" usually due to an unknown error. (I can't be arsed to VPN in to the office and find out the exact message or log for you atm