Who restarted my Windows server? [duplicate]
Solution 1:
In the System event log, filter by event id 1074, this will show by which process and on behalf of which user a reboot was initiated.
This was tested on Windows Server 2008.
Solution 2:
There should be a log at:
%windir%\system32\LogFiles\Shutdown
(which should be C:\WINDOWS\system32\LogFiles\Shutdown on a "standard" Windows Server 2000/2003 install)