Determining the Reason for a Windows Server Reboot


  • Must have login access to the server that rebooted


This document is intended to show engineers how to determine what caused a Windows machine to reboot.  Event Viewer is a very handy tool and is used to determine the reason for reboot. 

Reason for a Windows Server Reboot

  • Open Event Viewer
    • Start > Type ‘Event Viewer’
    • Start > Control Panel > Event Viewer
  • Navigate to Windows Logs > System inside of Event Viewer
  • Select “Filter Current Log” on the right hand side under Setup
  • In the “Filter Current Log” dialog box we need to enter ‘1074’ in the box that says “<All Event IDs>”
  • Right click the Event corresponding to the date/time when the server rebooted and select Properties.  The information in this box provides the reason for reboot, as well as the user who initiated the reboot.  

Leave a Reply