23

My server rebooted and I am not sure why. Is there a way to find out, e.g. perhaps someone did it manually, or as a result of a windows update or a blue screen?

I've looked in the Event Viewer, but I am not sure what to look for - there are million items there.

AngryHacker
  • 2,877
  • 6
  • 32
  • 33
  • Every event has a related Event ID. In the future, all you need to do is search the web for the ID of the event in question (in this case, a shutdown), and filter the log for that ID. – MDMarra Dec 16 '11 at 20:11

1 Answers1

29

You want to filter for Event ID 1074 in the System logs. That's the ID for shutdown.

If it wasn't a clean shutdown, you're going to have to sort through the memory dumps.

MDMarra
  • 100,734
  • 32
  • 197
  • 329
  • 3
    A nice tool to view the dump files: http://www.nirsoft.net/utils/blue_screen_view.html – James Jun 17 '14 at 15:12