Who restarted my Windows server?

Question

Is it possible on Windows Server 2000/2003/2008 machines to see which user rebooted the server?

I have found the shutdown event in the System event log, but it does not show which user initiated the reboot.

joar · Accepted Answer · 2012-05-01 12:37:02Z

up vote 9 down vote accepted

In the System event log, filter by event id 1074, this will show by which process and on behalf of which user a reboot was initiated.

This was tested on Windows Server 2008.

edited May 1 '12 at 12:37

answered Apr 26 '12 at 9:58

joar
21627

Lucas Kauffman · Answer 2 · 2012-04-26 09:50:45Z

up vote 4 down vote

There should be a log at:

\WINDOWS\system32\LogFiles\Shutdown

answered Apr 26 '12 at 9:50

Lucas Kauffman
12.7k52046

That folder does not exist on Windows Server 2008. – joar Apr 26 '12 at 9:59

3

well you did specify for 2000/2003 as well :) – Lucas Kauffman Apr 26 '12 at 10:10

I give you that! – joar Nov 4 '12 at 20:35

2 Answers