Skip to main content

How to check shutdowns on Windows Server

How do I know when the server has been shut down or restarted?​

Open the Event Viewer:

  1. Press Win + R
  2. Enter eventvwr.msc
  3. Go to Windows Logs > System

Search for the following events:

EventSourceMeaning1074User32Reboot or shutdown initiated by user, application or Windows Update6005EventLogLog service started (server powered on)6006EventLogLog service terminated gracefully (clean shutdown)6008EventLogUnexpected shutdown41Kernel-PowerReboot without clean shutdown (power loss, crash, hard reset)

How to find out who shut down the server?​

In event 1074, check the fields:

  • User
  • Responsible process
  • Reason for termination

Example:

The process C:\Windows\System32\shutdown.exe
has initiated the shutdown

User: Administrator

This indicates that the Administrator user performed the shutdown.

How to list only shutdown events?​

In PowerShell:

Get-WinEvent -FilterHashtable @{
LogName='System'
ID=1074,6006,6008,41
} | Select-Object TimeCreated, Id, ProviderName, Message

How to check the latest shutdowns quickly?​

CMD:

wevtutil qe System /q:"*[System[(EventID=1074 or EventID=6006 or EventID=6008 or EventID=41)]]" /f:text /c:20

Shows the 20 most recent events related to shutdowns and restarts.

How do I know if it was a crash or a normal shutdown?​

Normal shutdown​

Typically appear:

1074
6006
6005

Typical sequence:

  • User or system initiates shutdown (1074)
  • Log service closes (6006)
  • Server turns on again (6005)

Crash or power outage​

Typically appear:

41
6008

This indicates that Windows was unable to complete the shutdown correctly.

How to find out if a Windows Update restarted the server?​

In the Event Viewer:

Applications and Services Logs > Microsoft > Windows > WindowsUpdateClient > Operational

Or filter by ID:

Get-WinEvent -LogName System | Where-Object {$_.Id -eq 1074}

The message field will typically show:

Operating System: Service pack (Planned)

or

Windows Update

How to check the last boot of the server?​

CMD:

systeminfo | find "Boot Time"

PowerShell:

(Get-CimInstance Win32_OperatingSystem).LastBootUpTime

Shows exactly when Windows was last started.

If you still need help, open a ticket with our support.