Here is the syntax for the command:
It sounds like you are using the /c prompt. The event will happen if you use that prompt. Starting with SP4 new events including the one you have were introduced
Where:
\\computername
specifies a remote computer to shut down. Note that if no name is given but the utility is started with any of the other options, the local computername will be used.
/l
specifies a local shutdown.
/a
aborts a system shutdown. This is only possible during the timeout period. If this switch is used, all others are ignored.
/r
specifies that the computer should reboot after shutdown.
/t:xx
sets the timer for system shutdown in xx seconds. The default is 20 seconds.
"msg"
specifies an additional message of a maximum of 127 characters, surrounded by quotation marks.
/y
answers all following questions with yes.
/c
forces running applications to close.
Caution If you use the /c parameter, Windows NT ignores the application's option to save d