Is it possible on Windows Server 2000/2003/2008 machines to see which user rebooted the server?
I have found the shutdown event in the System event log, but it does not show which user initiated the reboot.
-
7Who took the cookie from the cookie jar?– Mark HendersonApr 26, 2012 at 9:30
-
2Who's on first?– WesleyApr 26, 2012 at 10:15
-
1No, What rebooted the server. Who installed the malware.– Bart SilverstrimApr 26, 2012 at 13:38
-
Was more than one person logged in at the time?– Harry JohnstonApr 30, 2012 at 2:40
-
So who was it that restarted the server?– KJ-SRSMay 1, 2012 at 14:58
|
Show 1 more comment
2 Answers
In the System event log, filter by event id 1074, this will show by which process and on behalf of which user a reboot was initiated.
This was tested on Windows Server 2008.
-
1
There should be a log at:
%windir%\system32\LogFiles\Shutdown
(which should be C:\WINDOWS\system32\LogFiles\Shutdown on a "standard" Windows Server 2000/2003 install)
answered Apr 26, 2012 at 9:50
-
-
6
-
1