Assume I want to know if a computer was shutdowned yesterday normally (e.g. through Start->Shutdown)
or crashed or was warm/cold rebooted.

How do I detect this?

I assume a "normal" shutdown writes a log entry.

But when I go to

Start->Settings->Control Panel->Administrative Tools->EventViewer

I could not see in any of the three logs an entry like

"Normal Shutdown"

So where exactly can I see what happened?

(Under Win2000 and WinXP if different)