Event ID: 1100

This event generates every time Windows Event Log service has shut down.

It also generates during normal system shutdown. This event doesn’t generate during emergency system reset. If the event was generated due to a normal system shutdown it will be preceded by event ID 1074 in the System log.

This event can be a sign of malicious action if someone shut down the Windows Event Log service to cover their activity.