How can I find out why a server rebooted?
My server rebooted and I am not sure why. Is there a way to find out, e.g. perhaps someone did it manually, or as a result of a windows update or a blue screen?
I've looked in the Event Viewer, but I am not sure what to look for - there are million items there.
Solution 1:
You want to filter for Event ID 1074 in the System logs. That's the ID for shutdown.
If it wasn't a clean shutdown, you're going to have to sort through the memory dumps.