Who restarted my Windows server?

Question

Is it possible on Windows Server 2000/2003/2008 machines to see which user rebooted the server?

I have found the shutdown event in the System event log, but it does not show which user initiated the reboot.

[Who took the cookie from the cookie jar?](http://en.wikipedia.org/wiki/Who_Stole_the_Cookie_from_the_Cookie_Jar%3F) — Mark Henderson, Apr 26 '12 at 09:30
[Who's on first?](http://www.youtube.com/watch?v=sShMA85pv8M) — Wesley, Apr 26 '12 at 10:15
No, *What* rebooted the server. *Who* installed the malware. — Bart Silverstrim, Apr 26 '12 at 13:38

joar · Accepted Answer · 2012-05-01T12:37:02.593

52

In the System event log, filter by event id 1074, this will show by which process and on behalf of which user a reboot was initiated.

This was tested on Windows Server 2008.

edited May 01 '12 at 12:37

answered Apr 26 '12 at 09:58

joar

score 5 · Answer 2 · edited Jun 03 '13 at 19:23

5

There should be a log at:

%windir%\system32\LogFiles\Shutdown

(which should be C:\WINDOWS\system32\LogFiles\Shutdown on a "standard" Windows Server 2000/2003 install)

edited Jun 03 '13 at 19:23

user66001

answered Apr 26 '12 at 09:50

Lucas Kauffman

That folder does not exist on Windows Server 2008. – joar Apr 26 '12 at 09:59
6

well you did specify for 2000/2003 as well :) – Lucas Kauffman Apr 26 '12 at 10:10
1

I give you that! – joar Nov 04 '12 at 20:35

2 Answers2