I have a windows server 2003 system which restarted for no apparent reason. Everything seems to be running fine now, but I want to know why it shutdown. I don't see any obvious signs of problems in the event logs. It is running on a UPS so I don't think it lost power.

  • How can I find the reason for the last shutdown in Windows Server 2003. I usually type a reason when I restart, and I have seen error codes when I go to the console after an unexpected restart. How can I retrieve that reason now?

  • Any other ideas about how to find out why the restart happened?


Open eventvwr → System.

View → Filter... → Event Id: 1074 and 1076. Comment field will contain what you typed in.

If there are no other events around that time to give you any clues, you may want to adjust your auditing settings to catch more items, but Sean Earp's link will probably give better details on that.

  • Event ID 1076 was the clue I was looking for, thanks. Of course since this was an unexpected shutdown, it does not give me much useful information. I will check out Sean's link to see if I can capture more info if this happens again.
    – railmeat
    Jul 2 '09 at 21:33
  • 2
    I've just came here for a quick reference for the same issue. However, I could find the shutdown event as ID 1074. I'm running windows server 2003 R2 SP2
    – amyassin
    Mar 29 '12 at 6:52
  • @amyassin, Both works for me. 1074 gives you "Information" type events while 1076 gives you "Warning" type events. @Kara, besides the checkbox "planned / unplanned", what other factors may affect whether an event is 1074 or 1076?
    – Pacerier
    Feb 27 '15 at 22:19

Take a look at the Technet information on the Shutdown Event Tracker, which is the OS component that keeps track of expected and unexpected shutdowns in Windows.


look at your event viewer and if there was a bsod you can check your dump file.

you should enable no restart option on systems or servers if you want to see the error message posted on the bsod. this is under control pane> system> advanced tab> startup recovery options.

you can use utilities from technet to read your dump file and it will usually show you if any drivers or which ones caused the issue. then you can reference the event id as mentioned to find out any solution.s


To open Event Viewer,

click Start, click Control Panel, double-click Administrative Tools, and then double-click Event Viewer


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.