If you are working for a big organization, it means there are lot of servers in your setup. Ensuring the servers are up and working fine is the duty of system administrators. Sometimes things don’t go well. Suppose you get a email saying that a server has been restarted and this needs to be investigated. You cannot ask each IT individual on who initiated the server restart. Could you find who restarted Windows Server ?. Yes there is a way to do that. I am sure many of you know how to do that. This post will come handy if you looking to find who restarted windows server. Of course event viewer is where we look for the information.
There is something called as Shutdown event tracker. This will allow the admins to track why a user initiated shutdown or a restart. It also gathers the reason why the users restarted or shutdown the computer. More info about it is documented here.
How to find out who restarted Windows Server
To find out who restarted windows server, log in to the server. The below steps work on Windows Server 2008, 2008 R2 and Server 2012 R2. Launch the Event Viewer (type eventvwr in run). In the event viewer console expand Windows Logs. Click on System and in the right pane click Filter Current Log.
The process C:\Windows\System32\RuntimeBroker.exe (CORPAD) has initiated the restart of computer CORPAD on behalf of user PRAJWAL\sccmadmin for the following reason: Other (Unplanned)
Reason Code: 0x5000000
Shutdown Type: restart