Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a windows server 2003 system which restarted for no apparent reason. Everything seems to be running fine now, but I want to know why it shutdown. I don't see any obvious signs of problems in the event logs. It is running on a UPS so I don't think it lost power.

  • How can I find the reason for the last shutdown in Windows Server 2003. I usually type a reason when I restart, and I have seen error codes when I go to the console after an unexpected restart. How can I retrieve that reason now?

  • Any other ideas about how to find out why the restart happened?

share|improve this question

3 Answers 3

up vote 2 down vote accepted

System Log; filter for Event ID: 1076; Comment field will contain what you typed in.

If there are no other events around that time to give you any clues, you may want to adjust your auditing settings to catch more items, but Sean Earp's link will probably give better details on that.

share|improve this answer
    
Event ID 1076 was the clue I was looking for, thanks. Of course since this was an unexpected shutdown, it does not give me much useful information. I will check out Sean's link to see if I can capture more info if this happens again. –  railmeat Jul 2 '09 at 21:33
1  
I've just came here for a quick reference for the same issue. However, I could find the shutdown event as ID 1074. I'm running windows server 2003 R2 SP2 –  amyassin Mar 29 '12 at 6:52

Take a look at the Technet information on the Shutdown Event Tracker, which is the OS component that keeps track of expected and unexpected shutdowns in Windows.

share|improve this answer

look at your event viewer and if there was a bsod you can check your dump file.

you should enable no restart option on systems or servers if you want to see the error message posted on the bsod. this is under control pane> system> advanced tab> startup recovery options.

you can use utilities from technet to read your dump file and it will usually show you if any drivers or which ones caused the issue. then you can reference the event id as mentioned to find out any solution.s

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.