This step-by-step guide will help you find out who restarted your Windows Server. You can discover which user or application initiated a shutdown or restart on your Windows Server.
This data is accessible through the Event Viewer. This tool is integral to the operating system, logging each event on your server for review.
To determine who initiated the restart of the Windows Server, follow these steps:
To delve deeper into these steps, continue reading.
To get started, you need to open Event Viewer. For that, search for the event viewer in the Taskbar search box and click on the individual search result. Alternatively, press Win+R to open the Run prompt, type eventvwr, and hit the Enter button.
After that, expand the Windows Logs section and select System.
Next, right-click on the System menu and click the Filter Current Log option.
Then, enter 1074 in the empty box and click the OK button.
For your information, Event ID 1074 denotes the restart and shutdown caused by a user or application. In other words, if a user or application restarts or shuts down your server, Event Viewer logs that with an Event ID 1074.
After that, filter the data, click on an event, and find the details accordingly.
The process C:WindowsSystem32RuntimeBroker.exe has initiated the restart of computer [computer-name] on behalf of user [username] for the following reason:
Reason
Reason code
Shutdown Type: restart
Comment:
You can discover details such as the user, the exact time and date, and the reason code. This information box is versatile, applicable to various events. Simply click on any historic event to access the desired information.
Read: How to check the Shutdown and Startup Log in Windows
To review the restart history on Windows Server, initiate by accessing the Event Viewer. In the Event Viewer, navigate to Windows Logs > System. Proceed by right-clicking on System and choosing Filter Current Log. Input the Event ID 1074 and press OK. This action will list all the restart and shutdown incidents recorded previously. Each event can be selected to explore further details.
To determine the cause behind an unexpected Windows restart, open the Event Viewer. Subsequently, choose Windows Logs and then the System menu. Right-click on the System menu and opt for Filter Current Log. Enter Event ID 1074 and confirm by clicking OK. Choose an event that correlates with the restart or shutdown time and examine the lower tab for specifics, including the rationale and the initiator of the restart.
Read: How to find and view BSOD log files in Event Viewer.
Published on September 6, 2024
July 25, 2024
July 18, 2024
September 5, 2024
September 4, 2024
Hudson Valley Host is premier provider of cutting-edge hosting solutions, specializing in delivering a seamless online experience for businesses and individuals. We offer a comprehensive range of hosting services, including Shared Hosting, VPS, Dedicated Servers, and Colocation. With 24/7 technical support, robust security measures, and user-friendly control panels, we empower clients in managing their online presence effortlessly. Hudson Valley Host is your trusted partner in achieving online success.
For Inquiries or to receive a personalized quote, please reach out to us through our contact form here or email us at sales@hudsonvalleyhost.com.
