How to check who rebooted the windows server machine

We might experience reboot issues with few of the windows servers/machines and might have noticed that the machine got restarted unexpectedly without our notice and it makes us annoyed.

There are few ways to figure out the exact cause of the reboot and who performed the reboot by following the below mentioned steps


Event viewer is the application that records each and every actions that we performed or executed in windows PC.

We can use Event viewer to find who rebooted the windows server/machine by using the event log codes

  • Event log code 1074 is used to record reboot logs
  • Click Start menu or Windows search bar and type Event logs and open it
  • Navigate to Event Viewer, browse Windows Logs and click System
  • In the Actions plane view click “Filter Current Log”
  • In Filter Current Log window type the event log code “1074” in Event ID field and click OK
  • We could see filtered view with event log 1074 were we can find who rebooted the machine by double clicking on the logs based on the date and time.

If you face any issue in following the same or if you have any other tips, feel free to let us know via comments session below.