Which user shutdown the server

1. Start the event Viewer

2. Right click on system and choose Filter Current Log…

3. At event sources click the dropdown list and check User32

4. In <All Event IDs> type  1074 and click OK

Related Event IDs :  1074, 1076, 6008 give information about system shutdowns.

Leave a Reply

Your email address will not be published. Required fields are marked *