I have a windows server 2003 system which restarted for no apparent reason. Everything seems to be running fine now, but I want to know why it shutdown. I don't see any obvious signs of problems in the event logs. It is running on a UPS so I don't think it lost power.
How can I find the reason for the last shutdown in Windows Server 2003. I usually type a reason when I restart, and I have seen error codes when I go to the console after an unexpected restart. How can I retrieve that reason now?
Any other ideas about how to find out why the restart happened?
Open
eventvwr
→ System.View → Filter... → Event Id:
1074
and1076
. Comment field will contain what you typed in.If there are no other events around that time to give you any clues, you may want to adjust your auditing settings to catch more items, but Sean Earp's link will probably give better details on that.
Take a look at the Technet information on the Shutdown Event Tracker, which is the OS component that keeps track of expected and unexpected shutdowns in Windows.
look at your event viewer and if there was a bsod you can check your dump file.
you should enable no restart option on systems or servers if you want to see the error message posted on the bsod. this is under control pane> system> advanced tab> startup recovery options.
you can use utilities from technet to read your dump file and it will usually show you if any drivers or which ones caused the issue. then you can reference the event id as mentioned to find out any solution.s
To open Event Viewer,
https://technet.microsoft.com/en-us/library/cc737766(v=ws.10).aspx#one