1. Start the event Viewer
2. Right click on system and choose Filter Current Log…
3. At event sources click the dropdown list and check User32
4. In <All Event IDs> type 1074 and click OK
Related Event IDs : 1074, 1076, 6008 give information about system shutdowns.