{"id":9926,"date":"2024-09-07T00:16:33","date_gmt":"2024-09-07T00:16:33","guid":{"rendered":"https:\/\/cheapwindowsvps.com\/blog\/tracing-the-culprit-how-to-find-out-who-restarted-your-windows-server\/"},"modified":"2025-01-20T11:41:27","modified_gmt":"2025-01-20T11:41:27","slug":"tracing-the-culprit-how-to-find-out-who-restarted-your-windows-server","status":"publish","type":"post","link":"https:\/\/cheapwindowsvps.com\/blog\/tracing-the-culprit-how-to-find-out-who-restarted-your-windows-server\/","title":{"rendered":"Tracing the Culprit: How to Find Out Who Restarted Your Windows Server"},"content":{"rendered":"

This step-by-step guide will help you find out who restarted your Windows Server<\/strong>. You can discover the user or application responsible for the shutdown or restart of your Windows Server.<\/p>\n

This data can be accessed using Event Viewer, a built-in utility that records each event on your server and provides a means to view this information.<\/p>\n

To determine who restarted Windows Server, simply follow these steps:<\/p>\n

To gain further insights into these procedures, continue with this guide.<\/p>\n

To get started, you need to open Event Viewer. For that, search for the event viewer<\/strong> in the Taskbar search box and click on the individual search result. Alternatively, press Win+R to open the Run prompt, type eventvwr<\/strong>, and hit the Enter button.<\/p>\n

After that, expand the Windows Logs<\/strong> section and select System<\/strong>.<\/p>\n

Next, right-click on the System<\/strong> menu and click the Filter Current Log<\/strong> option.<\/p>\n

Then, enter 1074<\/strong> in the empty box and click the OK button.<\/p>\n

For your information, Event ID 1074 denotes the restart and shutdown caused by a user or application. In other words, if a user or application restarts or shuts down your server, Event Viewer logs that with an Event ID 1074.<\/p>\n

After that, filter the data, click on an event, and find the details accordingly.<\/p>\n

The process C:WindowsSystem32RuntimeBroker.exe has initiated the restart of computer [computer-name] on behalf of user [username] for the following reason:<\/p>\n

Reason<\/p>\n

Reason code<\/p>\n

Shutdown Type: restart<\/p>\n

Comment:<\/p>\n

You can find the user, date\/time, reason code, etc. This detail box is not limited to one event. You can click on any past event to find the information that meets your requirements.<\/p>\n

Read:<\/strong> How to check the Shutdown and Startup Log in Windows<\/a><\/p>\n

To check the restart history on the Windows Server, you need to open the Event Viewer. Open the Event Viewer on your computer and select Windows Logs > System. Then, right-click on the System and select Filter Current Log<\/em>. Next, enter the Event ID 1074 and click the OK button. It displays all the restart and shutdown-related events that happened in the past. You can click on any event to find the details.<\/p>\n

To check why your Windows restarted, open the Event Viewer. Then, click on Windows Logs and select the System menu. Right-click on the System menu and select Filter Current Log<\/em>. Next, enter Event ID 1074 and click on OK. Then, select a restart or shut-down event according to the timing and find the details in the bottom tab. Here, it displays the reason why your Windows restarted and by whom.<\/p>\n

Read:<\/strong> How to find and view BSOD log files in Event Viewer.<\/a><\/p>\n

Published on September 6, 2024<\/strong><\/p>\n

Tags: Restart<\/a>, Server<\/a><\/p>\n

July 25, 2024<\/p>\n

July 18, 2024<\/p>\n

September 5, 2024<\/p>\n

September 4, 2024<\/p>\n","protected":false},"excerpt":{"rendered":"

This step-by-step guide will help you find out who restarted your Windows Server. You can discover the user or application responsible for the shutdown or restart of your\u2026<\/p>\n","protected":false},"author":1,"featured_media":9927,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-9926","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/9926","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/comments?post=9926"}],"version-history":[{"count":1,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/9926\/revisions"}],"predecessor-version":[{"id":10467,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/9926\/revisions\/10467"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/media\/9927"}],"wp:attachment":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/media?parent=9926"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/categories?post=9926"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/tags?post=9926"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}