Windows restart / shutdown history

Problem

Many times we need to find find out the reasons for Shutdowns/Unexpected restarts of Servers/Workstations. These event are logged in Evenlog with specific EventIDs.

Solution

By checking the specific EventIds, we can find out the time/source of Shurdown/Restarts.
Open Eventvwr and go to System log.
Filter the System log for these EventIds:
6008(The previous system shutdown was unexpected)
1074(The process X has initiated the restart / shutdown of computer...)
1076(he reason supplied by user X for the last unexpected shutdown of this computer is: ....)

Related articles

http://serverfault.com/questions/702828/windows-server-restart-shutdown-history