How to check who rebooted the windows server machine

We might experience reboot issues with few of the windows servers/machines and might have noticed that the machine got restarted unexpectedly without our notice and it makes us annoyed.

There are few ways to figure out the exact cause of the reboot and who performed the reboot by following the below mentioned steps

Steps:

Event viewer is the application that records each and every actions that we performed or executed in windows PC.

We can use Event viewer to find who rebooted the windows server/machine by using the event log codes

  • Event log code 1074 is used to record reboot logs
  • Click Start menu or Windows search bar and type Event logs and open it
  • Navigate to Event Viewer, browse Windows Logs and click System
  • In the Actions plane view click “Filter Current Log”
  • In Filter Current Log window type the event log code “1074” in Event ID field and click OK
  • We could see filtered view with event log 1074 were we can find who rebooted the machine by double clicking on the logs based on the date and time.

If you face any issue in following the same or if you have any other tips, feel free to let us know via comments session below.

If you find this post useful, please don’t forget to like our Facebook and twitter page for more such tutorials and tips.

Add a Comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.