How can I easily see a history of every time my Windows Server has restarted or shutdown and the reason why, including user-initiated, system-initiated, and system crashed?
The Windows Event Log is an obvious answer but what is the complete list of events that I should view?
I found these posts that partially answer my question:
- Windows server last reboot time includes several answers that partially address the full restart history
- View Shutdown Event Tracker logs under Windows Server 2008 R2 includes an additional event id
- Event Log time when Computer Start up / boot up includes some of the same event ids
but those don't cover every scenario AFAIK and the info is hard to understand because it is spread across multiple answers.
I have several versions of Windows Server so a solution that works for at least versions 2008, 2008 R2, 2012, and 2012 R2 would be ideal.