Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible on Windows Server 2000/2003/2008 machines to see which user rebooted the server?

I have found the shutdown event in the System event log, but it does not show which user initiated the reboot.

share|improve this question
Who's on first? –  Wesley Apr 26 '12 at 10:15
No, What rebooted the server. Who installed the malware. –  Bart Silverstrim Apr 26 '12 at 13:38
Was more than one person logged in at the time? –  Harry Johnston Apr 30 '12 at 2:40
So who was it that restarted the server? –  KJ-SRS May 1 '12 at 14:58

2 Answers 2

up vote 17 down vote accepted

In the System event log, filter by event id 1074, this will show by which process and on behalf of which user a reboot was initiated.

This was tested on Windows Server 2008.

share|improve this answer
Also works on Windows Server 2003 (SP 2) –  Deruijter Jul 17 '13 at 8:20

There should be a log at:


(which should be C:\WINDOWS\system32\LogFiles\Shutdown on a "standard" Windows Server 2000/2003 install)

share|improve this answer
That folder does not exist on Windows Server 2008. –  joar Apr 26 '12 at 9:59
well you did specify for 2000/2003 as well :) –  Lucas Kauffman Apr 26 '12 at 10:10
I give you that! –  joar Nov 4 '12 at 20:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.