1] View shutdown and restart events from Event Viewer In Event Viewer, select Windows Logs > System from the left pane. From the right, click on the Filter Current Log link. Type in 41,1074,6006,6008 into the box below Includes/Exclude Event IDs… Hit Ok. Windows then displays all shutdown-related events.

How do I view the shutdown event log?

1] View shutdown and restart events from Event Viewer In Event Viewer, select Windows Logs > System from the left pane. From the right, click on the Filter Current Log link. Type in 41,1074,6006,6008 into the box below Includes/Exclude Event IDs… Hit Ok. Windows then displays all shutdown-related events.

How do I enable Shutdown Event Tracker?

Expand Computer Configuration, expand Administrative Templates, and then expand System. Double-click Display Shutdown Event Tracker. Select Enabled. In the Shutdown Event Tracker should be displayed box, select Always, and then select OK.

How do I check the reboot log in Event Viewer?

View Shutdown and Restart Log from Event Viewer Open Event Viewer (press Win + R[Run] and type eventvwr). In the left pane, open “Windows Logs >> System.” In the middle pane, you will get a list of events that occurred while Windows was running. You can sort the event log with the Event ID.

How do you check when was the server shut down?

How to Check the Last Shutdown Time Using the Event Viewer

  1. Open the Start menu.
  2. Type “Event Viewer” in the search box and hit Enter.
  3. Double-click on the Windows Logs folder in the left-hand pane.
  4. Right-click on “System” and select “Filter Current Log…”
  5. A window will pop up.

Can you disable shutdown?

User Configuration > Administrative Templates > Start Menu and Taskbar > Remove and Prevent Access to the Shutdown, Restart ….

How do I fix the previous System shutdown was unexpected?

5 Answers

  1. Open event viewer.
  2. expand Windows Logs.
  3. click on system to view it.
  4. right-click on system and select Filter Current Log.
  5. in Event Sources: select User32.
  6. change to 1074.
  7. click OK.

What is event ID for server shutdown?

Event ID 1074: System has been shutdown by a process/user. This event is written when an application causes the system to restart, or when the user initiates a restart or shutdown by clicking Start or pressing CTRL+ALT+DELETE, and then clicking Shut Down.

How do I enable or disable the shutdown event tracker?

You can configure the registry to enable or disable the Shutdown Event Tracker. The Windows Server 2003 default installation enables Shutdown Event Tracker by default. However, you can configure the registry settings to enable it or disable it on demand. The process is described in Exercise 9.09.

Why can’t I change the shutdown policy for a single machine?

The local Group Policy can dictate the shutdown policy for the domain. This is not feasible for a single machine configuration. Another reason is the lack of terminal server access to local Group Policy settings. You can use the Registry Editor to edit the remote computer’s registry in this case.

Why do I need to log restart and shutdown events?

If there’s a reason to restart or shutdown, it’s handy for many IT companies to log and document these reasons so over time they may analyze why the restart or shutdown was required to maximize their Windows session uptime. For this, you can enable the Shutdown Event Tracker feature.

How do I display the reason for a sudden shutdown?

D (Indicates that the reason should be displayed in the sudden shutdown dialog box.)For example, if you want a reason to be displayed in the sudden shutdown dialog box, the shutdown is unplanned, and the shutdown corresponds to a major reason 2 and to a minor reason 2, type the following value name: D;2;2.