Find out why PC just restarted for no reason

I am using Windows 7. For some reason my PC just shut down and restarted itself. I did not receive any warnings or indication of this. Is there a way to find out why my PC just restarted?

These are the Event ID's I found helpful in tracking down a Reboot:

Event ID 1074 (Source: USER32) is "...has initiated the restart..."
Event ID 6005 (Source: EventLog) is "Event Log Service was Started".
Event ID 6006 (Source: EventLog) is "Event Log Service was Stopped".
Event ID 7001 (Source: WinLogon) is "User Logon".
Event ID 7002 (Source: WinLogon) is "User Logoff".

6005 is a good indicator the computer is Booting/Powering Up.
6006 is a good indicator the computer is Rebooting/Shutting Down.


1074 is what I see when something has triggered a reboot of my system (usually a windows update).
Example:

The process C:\Windows\CCM\CcmExec.exe (SomeComputerName) has initiated the restart of computer SomeComputerName on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
Reason Code: 0x80020001
Shutdown Type: restart
Comment: Your computer will restart at 01/07/2017 08:14:38 PM to complete the installation of applications and software updates.

Online the description for 1074 reads:

This event is written when an application causes the system to restart, or when the user initiates a restart or shutdown by clicking Start or pressing CTRL+ALT+DELETE, and then clicking Shut Down.

My log has a bunch of Informational Event ID's for 7036, so I chose to ignore those (as noise).
For the "Filter Current Log..." I punched this in to Include/Exclude the following:

-7036,1074,6005,6006,7001,7002

On my machine, I saw this:

A reboot notice went out at 6:14pm (while I was away at dinner).
The machine logged me out at 8:15pm.
The machine powered down at 8:16pm.
The machine powered up at 8:17pm (which is indicative of a Warm Reboot).
When I returned home from dinner and a movie, I logged back in at 8:59pm.

This is how I knew our IT had set up a policy that was only giving me a 2-hour notice for a reboot.
Your reasons for a reboot may be different, so jot down these times and look for anything logged around those times.

Nirsoft's free tool, TurnedOnTimesView, displays reasons.

The answer from MikeTeeVee is already a good starting place, however you also might want to include some of the Kernel-Power and Kernel-General events (12,13,89,109,41,42).

These are respectively: operating system start, operating system shutdown, power manager shutdown, reboot without clean shutdown, idle system entering sleep, sleep operation failed. These certainly have some overlap with the Event IDs already provided, but these may add additional context if needed.

The combined Include/Exclude Event IDs field:

-7036,1074,6005,6006,7001,7002,6008,12,13,109,41,42,43,1