How do I find the reason for the last shutdown in Windows Server 2003?

Solution 1:

Open eventvwr → System.

View → Filter... → Event Id: 1074 and 1076. Comment field will contain what you typed in.

If there are no other events around that time to give you any clues, you may want to adjust your auditing settings to catch more items, but Sean Earp's link will probably give better details on that.

Solution 2:

Take a look at the Technet information on the Shutdown Event Tracker, which is the OS component that keeps track of expected and unexpected shutdowns in Windows.

Solution 3:

look at your event viewer and if there was a bsod you can check your dump file.

you should enable no restart option on systems or servers if you want to see the error message posted on the bsod. this is under control pane> system> advanced tab> startup recovery options.

you can use utilities from technet to read your dump file and it will usually show you if any drivers or which ones caused the issue. then you can reference the event id as mentioned to find out any solution.s