Who restarted my server / troubleshoot unplanned events

Although the Windows Server 2012 “auto update” was configured to only check and download the updates, there was an unplanned server reboot.

An issue also arises when multiple administrators are administering servers..  trying to blame each other who restarted/shutdown/applied updates.

Well, from event logs its easier to identify who rebooted server and also can add custom view to event diagnosis to filter unplanned events.

To identify who restarted server:

Goto event viewer, Windows Logs, Systems and choose “Filter Current Log..”  from actions pane, search for event ID# 1074

Create custom event to troubleshoot unplanned server reboot events:

follow this link (Create a Custom View in Event Viewer to show Reboot Events)