This step-by-step guide will help you find out who restarted your Windows Server. You can find the user or application that shut down or restarted your Windows Server.
This information can be found using Event Viewer. This built-in utility logs every event on your server and allows you to view that information.
How to find who restarted Windows Server
To find who restarted Windows Server, follow these steps:
- Search for “event viewer” in the Taskbar search box.
- Click on the individual search result.
- Expand Windows Logs.
- Right-click on System and select Filter Current Log.
- Enter 1074 in the empty box and click OK.
- Click on an event to find the details.
To learn more about these steps, continue reading.
To get started, you need to open Event Viewer. For that, search for the event viewer in the Taskbar search box and click on the individual search result. Alternatively, press Win+R to open the Run prompt, type eventvwr, and hit the Enter button.
After that, expand the Windows Logs section and select System.
Next, right-click on the System menu and click the Filter Current Log option.
Then, enter 1074 in the empty box and click the OK button.
For your information, Event ID 1074 denotes the restart and shutdown caused by a user or application. In other words, if a user or application restarts or shuts down your server, Event Viewer logs that with an Event ID 1074.
After that, filter the data, click on an event, and find the details accordingly.
It displays information like this:
The process C:\Windows\System32\RuntimeBroker.exe has initiated the restart of computer [computer-name] on behalf of user [username] for the following reason:
[reason]
Reason code
Shutdown Type: restart
Comment:
You can find the user, date/time, reason code, etc. This detail box is not limited to one event. You can click on any past event to find the information that meets your requirements.
Read: How to check the Shutdown and Startup Log in Windows
How to check Restart history in Windows?
To check the restart history on the Windows Server, you need to open the Event Viewer. Open the Event Viewer on your computer and select Windows Logs > System. Then, right-click on the System and select Filter Current Log. Next, enter the Event ID 1074 and click the OK button. It displays all the restart and shutdown-related events that happened in the past. You can click on any event to find the details.
How to check why Windows restarted?
To check why your Windows restarted, open the Event Viewer. Then, click on Windows Logs and select the System menu. Right-click on the System menu and select Filter Current Log. Next, enter Event ID 1074 and click on OK. Then, select a restart or shut-down event according to the timing and find the details in the bottom tab. Here, it displays the reason why your Windows restarted and by whom.
