joar Asked: 2012-04-27 01:25:42 +0800 CST2012-04-27 01:25:42 +0800 CST 2012-04-27 01:25:42 +0800 CST Who restarted my Windows server? [duplicate] 772 Is it possible on Windows Server 2000/2003/2008 machines to see which user rebooted the server? I have found the shutdown event in the System event log, but it does not show which user initiated the reboot. windows logging log-files boot windows-event-log 2 Answers Voted Best Answer joar 2012-04-27T01:58:22+08:002012-04-27T01:58:22+08:00 In the System event log, filter by event id 1074, this will show by which process and on behalf of which user a reboot was initiated. This was tested on Windows Server 2008. Lucas Kauffman 2012-04-27T01:50:45+08:002012-04-27T01:50:45+08:00 There should be a log at: %windir%\system32\LogFiles\Shutdown (which should be C:\WINDOWS\system32\LogFiles\Shutdown on a "standard" Windows Server 2000/2003 install)
In the
Systemevent log, filter by event id1074, this will show by which process and on behalf of which user a reboot was initiated.This was tested on Windows Server 2008.
There should be a log at:
(which should be
C:\WINDOWS\system32\LogFiles\Shutdownon a "standard" Windows Server 2000/2003 install)