Today I arrived at the office of an client and the Hyper V server was turnoff. In the Windows Event log is register that the admin user has send a shutdown command. I'm not the only one that has access to this user.
How can I find out from what IP the admin user was login when this command was requested (What event ID I'm need to lookup)?
Thanks.