JohnC's questions

I'm responsible for an Azure network and various IaaS and PaaS services. I'm looking at Azure Network Watcher Traffic Anaysis that indicates ports receiving traffic including:

L7Protocol: fmsascon 
DestPort: 16001

I googled "fmsascon" and found various terse or generic content such as IANA Service Name and Transport Protocol Port Number Registry, pg 122:

fmsascon 16001 tcp Administration Server Connector [Mark_Davidson] [Mark_Davidson] 2010-10-06
 16001 udp Reserved

This means nothing to me.

Can someone explain what “fmsascon” is as a network layer L7 protocol and what port 16001 is typically used for?

How can I easily see a history of every time my Windows Server has restarted or shutdown and the reason why, including user-initiated, system-initiated, and system crashed?

The Windows Event Log is an obvious answer but what is the complete list of events that I should view?

I found these posts that partially answer my question:

• Windows server last reboot time includes several answers that partially address the full restart history
• View Shutdown Event Tracker logs under Windows Server 2008 R2 includes an additional event id
• Event Log time when Computer Start up / boot up includes some of the same event ids

but those don't cover every scenario AFAIK and the info is hard to understand because it is spread across multiple answers.

I have several versions of Windows Server so a solution that works for at least versions 2008, 2008 R2, 2012, and 2012 R2 would be ideal.