So just filter for event ID 1074:

“event ID 1074 from USER32 will show you who/why the system was shutdown.”

Reference:
http://community.spiceworks.com/topic/135612-server-2008-r2-shutdown-restart-event-ids

FYI…For ALL security related eventID’s:
http://www.microsoft.com/en-za/download/details.aspx?id=35753

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s