Inspecting forced shutdown to a computer

hi,

is there a way to find out if a user initiated a forced shutdown/logoff to a computer?i know that windows has built in logs that monitors activity and errors that occurs to the system but i’d like to know which log should i look at and what process should i look for in determining a forced shutdown/logoff command.