Who restarted my server / troubleshoot unplanned events

Although the Windows Server 2012 “auto update” was configured to only check and download the updates, there was an unplanned server reboot.

An issue also arises when multiple administrators are administering servers..  trying to blame each other who restarted/shutdown/applied updates.

Well, from event logs its easier to identify who rebooted server and also can add custom view to event diagnosis to filter unplanned events.

To identify who restarted server:

Goto event viewer, Windows Logs, Systems and choose “Filter Current Log..”  from actions pane, search for event ID# 1074

Create custom event to troubleshoot unplanned server reboot events:

follow this link (Create a Custom View in Event Viewer to show Reboot Events)

Advertisements

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s