23

My server rebooted and I am not sure why. Is there a way to find out, e.g. perhaps someone did it manually, or as a result of a windows update or a blue screen?

I've looked in the Event Viewer, but I am not sure what to look for - there are million items there.

Improve this question
1
  • Every event has a related Event ID. In the future, all you need to do is search the web for the ID of the event in question (in this case, a shutdown), and filter the log for that ID.
    – MDMarra
    Dec 16, 2011 at 20:11

1 Answer 1

Reset to default
29

You want to filter for Event ID 1074 in the System logs. That's the ID for shutdown.

If it wasn't a clean shutdown, you're going to have to sort through the memory dumps.

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.