19

My server rebooted and I am not sure why. Is there a way to find out, e.g. perhaps someone did it manually, or as a result of a windows update or a blue screen?

I've looked in the Event Viewer, but I am not sure what to look for - there are million items there.

  • Every event has a related Event ID. In the future, all you need to do is search the web for the ID of the event in question (in this case, a shutdown), and filter the log for that ID. – MDMarra Dec 16 '11 at 20:11
25

You want to filter for Event ID 1074 in the System logs. That's the ID for shutdown.

If it wasn't a clean shutdown, you're going to have to sort through the memory dumps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.