This step-by-step guide will help you find out who restarted your Windows Server. You can find the user or application that shut down or restarted your Windows Server.
This information can be found using Event Viewer. This built-in utility logs every event on your server and allows you to view that information.
To find who restarted Windows Server, follow these steps:
To learn more about these steps, continue reading.
To get started, you need to open Event Viewer. For that, search for the event viewer in the Taskbar search box and click on the individual search result. Alternatively, press Win+R to open the Run prompt, type eventvwr, and hit the Enter button.
After that, expand the Windows Logs section and select System.
Next, right-click on the System menu and click the Filter Current Log option.
Then, enter 1074 in the empty box and click the OK button.
For your information, Event ID 1074 denotes the restart and shutdown caused by a user or application. In other words, if a user or application restarts or shuts down your server, Event Viewer logs that with an Event ID 1074.
After that, filter the data, click on an event, and find the details accordingly.
The process C:WindowsSystem32RuntimeBroker.exe has initiated the restart of computer [computer-name] on behalf of user [username] for the following reason:
[reason]
Reason code
Shutdown Type: restart
Comment:
You can find the user, date/time, reason code, etc. This detail box is not limited to one event. You can click on any past event to find the information that meets your requirements.
Read: How to check the Shutdown and Startup Log in Windows
To check the restart history on the Windows Server, you need to open the Event Viewer. Open the Event Viewer on your computer and select Windows Logs > System. Then, right-click on the System and select Filter Current Log. Next, enter the Event ID 1074 and click the OK button. It displays all the restart and shutdown-related events that happened in the past. You can click on any event to find the details.
To check why your Windows restarted, open the Event Viewer. Then, click on Windows Logs and select the System menu. Right-click on the System menu and select Filter Current Log. Next, enter Event ID 1074 and click on OK. Then, select a restart or shut-down event according to the timing and find the details in the bottom tab. Here, it displays the reason why your Windows restarted and by whom.
Read: How to find and view BSOD log files in Event Viewer.
Published on September 6, 2024
July 25, 2024
July 18, 2024
September 5, 2024
September 4, 2024
Welcome to DediRock, your trusted partner in high-performance hosting solutions. At DediRock, we specialize in providing dedicated servers, VPS hosting, and cloud services tailored to meet the unique needs of businesses and individuals alike. Our mission is to deliver reliable, scalable, and secure hosting solutions that empower our clients to achieve their digital goals. With a commitment to exceptional customer support, cutting-edge technology, and robust infrastructure, DediRock stands out as a leader in the hosting industry. Join us and experience the difference that dedicated service and unwavering reliability can make for your online presence. Launch our website.