--- title: "Who Really Restarted Windows Server? Event ID 1074 and 6008" description: "Use one Get-WinEvent filter to find which account, process, and reason restarted a Windows Server, from Event ID 1074 and 6008 logs." canonical: "https://adamtheautomator.com/event-id-1074-windows-server-restart/" --- # Who Really Restarted Windows Server? Event ID 1074 and 6008 > Use one Get-WinEvent filter to find which account, process, and reason restarted a Windows Server, from Event ID 1074 and 6008 logs. Source: https://adamtheautomator.com/event-id-1074-windows-server-restart/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Who Really Restarted Windows Server? Event ID 1074 and 6008](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b81798ecbd4ce17ad4211/3af27311d4ef00790ee9d17c229fa6097b6ee8b242b0a21e0b024c9807f61639.jpg) # Who Really Restarted Windows Server? Event ID 1074 and 6008 [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)22 October 20263 min. read Categories: [IT Ops](/category/it-ops/) Tags:[PowerShell](/tag/powershell/)[Windows](/tag/windows/)[Microsoft Windows Server](/tag/microsoft-windows-server/)[Windows Events](/tag/windows-events/) Table of Contents * [Pull the Restart Events with One Get-WinEvent Filter](#pull-the-restart-events-with-one-get-winevent-filter) * [Read the Fields of Event 1074](#read-the-fields-of-event-1074) * [The Seven Values Inside Event 1074](#the-seven-values-inside-event-1074) * [When the User Is SYSTEM](#when-the-user-is-system) * [Check a Remote Server or a Past Week](#check-a-remote-server-or-a-past-week) * [What to Do When There Is No Event 1074](#what-to-do-when-there-is-no-event-1074) Can you prove who restarted the server at 2:14 a.m.? Your patch agent or an admin running `shutdown /r` remotely may have asked for it, or the machine may have crashed with nobody asking. Paging through System log entries in Event Viewer to find out is slow. Prove the answer from the System log. Make Event ID 1074 name the account and reason, or make Event ID 6008 show nobody asked. Pull both with one [`Get-WinEvent`](https://adamtheautomator.com/get-winevent/) filter. ## Pull the Restart Events with One Get-WinEvent Filter Open PowerShell as an Administrator on the server first. Microsoft’s [Get-WinEvent reference](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.6) warns that without elevation you might get errors retrieving some logs. Everything below uses features documented for Windows PowerShell 5.1 and PowerShell 7.6. `-FilterHashtable` filters events as they are retrieved. The slower route is piping the whole log into `Where-Object`. Microsoft’s [FilterHashtable guide](https://learn.microsoft.com/en-us/powershell/scripting/samples/creating-get-winevent-queries-with-filterhashtable?view=powershell-7.6) calls it inefficient: “When you work with large event logs, it’s not efficient to send objects down the pipeline to a Where-Object command.” ```powershell Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 1074, 6008 } -MaxEvents 20 | ForEach-Object { $p = $_.Properties if ($_.Id -eq 1074) { [pscustomobject]@{ Time = $_.TimeCreated Id = $_.Id User = $p[6].Value Process = $p[0].Value Action = $p[4].Value Reason = $p[2].Value Comment = $p[5].Value } } else { [pscustomobject]@{ Time = $_.TimeCreated Id = $_.Id User = '' Process = '' Action = '' Reason = 'Unexpected shutdown, no requester logged' Comment = '' } } } | Format-Table -AutoSize -Wrap ``` `Id = 1074, 6008` accepts an array and returns both events in one pass. `Get-WinEvent` returns newest first, which makes `-MaxEvents 20` the twenty most recent restart and shutdown events. Only 1074 carries a requester, so the `else` branch writes a fixed reason for 6008 rows. ## Read the Fields of Event 1074 Each 1074 row identifies the requester and the reason. Its data has no field names. The script reads it by position. ### The Seven Values Inside Event 1074 The User32 provider writes Event 1074 with seven unnamed values. The [Event 1074 reference on evtxparser](https://www.evtxparser.com/en/events/system/1074) lists them in this order. The table adds each one’s zero-based index in the `Properties` array. | Index | Value | Example | | --- | --- | --- | | 0 | Requesting process, often with the computer in parentheses | `C:\Windows\system32\shutdown.exe (SRV01)` | | 1 | Computer being restarted | `SRV01` | | 2 | Reason text | `Operating System: Upgrade (Planned)` | | 3 | Reason code in hex | `0x80020003` | | 4 | Action | `restart`, `power off` | | 5 | Comment from the requester | often empty | | 6 | Account the request ran under | `CONTOSO\admin` | The diagram below maps each index to its output column. ![Event 1074 field map](https://adamtheautomator.com/wp-content/uploads/publisher/fb1a3e7f947757134965aa871f07ed356d576f80728c1a5e1876e15aa1b7251c.png) ### When the User Is SYSTEM Patch agents and scheduled tasks show up in the User column as `NT AUTHORITY\SYSTEM`. Check these columns next: | Column | What it tells you | | --- | --- | | Process | The tool to check. Microsoft’s [guide to unexpected restarts](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/troubleshoot-unexpected-reboots-system-event-logs) notes that “In many cases, the process name helps determine what potentially called for the reboot.” | | Comment | The [shutdown command](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown) accepts `/c` with up to 512 characters. Scripted restarts often explain themselves here. | | Reason | `Other (Unplanned)` with code `0x0` can mean the requester set no reason. Microsoft says omitting `/d` might log the shutdown with no specified reason. | * * * _**Reality Check: SYSTEM in the User column points to automation as the requester. Finding the person who set that automation up takes the management tool’s own audit trail or logon events in the Security log.**_ * * * ## Check a Remote Server or a Past Week `-ComputerName` accepts a hostname or IP address. The [ComputerName parameter](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.6#-computername) takes only one computer at a time. To check several servers, loop over the list. `-ComputerName` does not rely on PowerShell remoting. Each target needs its firewall open for remote event log access. ```powershell foreach ($server in 'SRV01', 'SRV02') { Get-WinEvent -ComputerName $server -FilterHashtable @{ LogName = 'System' Id = 1074 StartTime = (Get-Date).AddDays(-7) } | ForEach-Object { [pscustomobject]@{ Server = $server Time = $_.TimeCreated User = $_.Properties[6].Value Process = $_.Properties[0].Value Reason = $_.Properties[2].Value } } } ``` `StartTime` limits the search to the last seven days. This query asks for 1074 only and skips unexpected restarts. For any server missing from the output, rerun the first query with `-ComputerName`. * * * _**Quick Win: For one restart per server, add ******`-MaxEvents 1`****** after ******`-ComputerName $server`******; the most recent event comes back first.**_ * * * ## What to Do When There Is No Event 1074 Usually nothing asked Windows to shut down when a 6008 appears with no 1074 beside it. According to [Microsoft’s troubleshooting article](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/troubleshoot-unexpected-reboots-system-event-logs), “With an unexpected reboot, there usually isn’t an Event ID 1074 log entry.” Event 6008 reports only the previous shutdown time. Look for the cause in the neighboring events: | Event ID | Source | What it records | | --- | --- | --- | | 1074 | User32 | A process asked for the restart, with account and reason | | 13 | Kernel-General | The operating system is shutting down | | 6008 | EventLog | The previous shutdown was unexpected | | 41 | Kernel-Power | The system rebooted without cleanly shutting down first | | 1001 | WER-SystemErrorReporting | The computer rebooted from a bug check, with stop code and dump path | In a normal restart, 1074 comes first and 13 follows. An unexpected restart usually leaves 41 and 6008 with no 1074 before them. The diagram below shows both sequences. ![Normal vs unexpected restart](https://adamtheautomator.com/wp-content/uploads/publisher/a322cff5c8b1c13710bb69f8c34115bab595c305c9650805ba174e6fcddd73dc.png) To confirm the log kept its history, check its mode, size limit, and record count: ```powershell Get-WinEvent -ListLog System | Format-List LogMode, MaximumSizeInBytes, RecordCount ``` * * * _**Key Insight: With LogMode set to _**[_**Circular**_](https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogmode)**_, each new event replaces the oldest one once the log is full. On a busy server, a restart from months ago can be gone before you look.**_ * * * Run the 1074 and 6008 query and read the newest rows: * User is SYSTEM: take the process name to whoever owns that patch or scheduling tool. * Only a 6008: check the Kernel-Power 41 events around it. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fevent-id-1074-windows-server-restart%2F&text=Who%20Really%20Restarted%20Windows%20Server%3F%20Event%20ID%201074%20and%206008)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fevent-id-1074-windows-server-restart%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fevent-id-1074-windows-server-restart%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b81d9a96fd378dc47c60a/121705eb357e56699bca0c73e19055d636ddcfdd7418053591d9dbf69af050e2.jpg) ### [Audit Every SMB Share Permission with Get-SmbShareAccess](/audit-smb-share-permissions-powershell/) Audit SMB share permissions with Get-SmbShareAccess, flag Everyone and Full Control grants, and check the NTFS ACL before you revoke anything. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b813190efe4fbf5ba49f1/01cf2782293526c501009180bd8555b6e73ab2cef8c62a48d76f7970916c3080.jpg) ### [Migrate DHCP Without Losing Leases with Export-DhcpServer](/migrate-dhcp-server-export-dhcpserver/) Move a DHCP server with Export-DhcpServer and Import-DhcpServer, keeping leases intact, then authorize the new server in Active Directory. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b817aab5dca59f1ca0e14/38378bffb6e067df12a1bd90a3921833213a6e328f7d3baabd1fae698d38ddfd.jpg) ### [Fix Kerberos Clock Skew Logon Failures Using w32tm](/fix-kerberos-clock-skew-w32tm/) Fix Kerberos clock skew logon failures by checking w32tm sources, pointing the PDC emulator at NTP, and resyncing drifted clients. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)