Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My server rebooted and I am not sure why. Is there a way to find out, e.g. perhaps someone did it manually, or as a result of a windows update or a blue screen?

I've looked in the Event Viewer, but I am not sure what to look for - there are million items there.

share|improve this question
Every event has a related Event ID. In the future, all you need to do is search the web for the ID of the event in question (in this case, a shutdown), and filter the log for that ID. – MDMarra Dec 16 '11 at 20:11

You want to filter for Event ID 1074 in the System logs. That's the ID for shutdown.

If it wasn't a clean shutdown, you're going to have to sort through the memory dumps.

share|improve this answer
A nice tool to view the dump files: – James Jun 17 '14 at 15:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.