Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

Is it possible on Windows Server 2000/2003/2008 machines to see which user rebooted the server?

I have found the shutdown event in the System event log, but it does not show which user initiated the reboot.

share|improve this question

marked as duplicate by Michael Hampton Aug 7 '14 at 0:12

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Who's on first? – Wesley Apr 26 '12 at 10:15
No, What rebooted the server. Who installed the malware. – Bart Silverstrim Apr 26 '12 at 13:38
Was more than one person logged in at the time? – Harry Johnston Apr 30 '12 at 2:40
So who was it that restarted the server? – KJ-SRS May 1 '12 at 14:58
up vote 33 down vote accepted

In the System event log, filter by event id 1074, this will show by which process and on behalf of which user a reboot was initiated.

This was tested on Windows Server 2008.

share|improve this answer
Also works on Windows Server 2003 (SP 2) – Deruijter Jul 17 '13 at 8:20

There should be a log at:


(which should be C:\WINDOWS\system32\LogFiles\Shutdown on a "standard" Windows Server 2000/2003 install)

share|improve this answer
That folder does not exist on Windows Server 2008. – joar Apr 26 '12 at 9:59
well you did specify for 2000/2003 as well :) – Lucas Kauffman Apr 26 '12 at 10:10
I give you that! – joar Nov 4 '12 at 20:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.