29

Is it possible on Windows Server 2000/2003/2008 machines to see which user rebooted the server?

I have found the shutdown event in the System event log, but it does not show which user initiated the reboot.

6

2 Answers 2

52

In the System event log, filter by event id 1074, this will show by which process and on behalf of which user a reboot was initiated.

This was tested on Windows Server 2008.

1
  • 1
    Also works on Windows Server 2003 (SP 2)
    – Deruijter
    Commented Jul 17, 2013 at 8:20
5

There should be a log at:

%windir%\system32\LogFiles\Shutdown

(which should be C:\WINDOWS\system32\LogFiles\Shutdown on a "standard" Windows Server 2000/2003 install)

3
  • That folder does not exist on Windows Server 2008.
    – joar
    Commented Apr 26, 2012 at 9:59
  • 6
    well you did specify for 2000/2003 as well :) Commented Apr 26, 2012 at 10:10
  • 1
    I give you that!
    – joar
    Commented Nov 4, 2012 at 20:35

Not the answer you're looking for? Browse other questions tagged .