How Should I Have Handled an Awkward IT Situation?

You’re totally right that you have to monitor machines, but it’s definitely a best practice to ask permission before accessing someone’s computer. A simple, polite call or message can help set that expectation and keep everyone on the same page.

Instead of just saying you'll check it now, I think a quick message like, "Hey, I’ll need to remote into your computer to check the logs, is that cool?" can go a long way. This way, you make sure they're aware, and it gives them a chance to prepare.

Looks like this user is a bit dramatic. You did the right thing by documenting the conversation. I'd keep doing my job, but maybe implement a clearer communication strategy with your users about what to expect when they ask for IT help. It will help prevent future complaints.

You could check event logs remotely without taking control of their machine. If you have the right access permissions, there are ways to filter logs for shutdown events, which might also save you from connecting at all.

It sounds like you might not have made it clear that you needed to remote in to gather logs. Next time, you could use a remote support tool that prompts the user before connecting. It's always good to give them a heads-up and maybe ask them to close sensitive information beforehand. That way, they know what’s happening and it helps avoid misunderstandings like this one.