Pre-Requisites
- Must have login access to the server that rebooted
Purpose
This document is intended to show engineers how to determine what caused a Windows machine to reboot. Event Viewer is a very handy tool and is used to determine the reason for reboot.
Reason for a Windows Server Reboot
- Open Event Viewer
- Start > Type ‘Event Viewer’
- Start > Control Panel > Event Viewer
- Navigate to Windows Logs > System inside of Event Viewer
- Select “Filter Current Log” on the right hand side under Setup
- In the “Filter Current Log” dialog box we need to enter ‘1074’ in the box that says “<All Event IDs>”
- Right click the Event corresponding to the date/time when the server rebooted and select Properties. The information in this box provides the reason for reboot, as well as the user who initiated the reboot.
