Windows Server Which user shutdown the server 1. Start the event Viewer 2. Right click on system and choose Filter Current Log… 3. At event sources click the dropdown list and check User32 4. In <All Event IDs> …