2

Where can I find the shutdown reason notes for Windows Server 2003?

I sometimes fill these in, but I never see them again.

Abel
  • 1,473
MatthewMartin
  • 544

3 Answers3

3

Shutdowns events are located in the System Event log (Event 1074).

You can filter for Source: USER32 If your running windows 2003 and specify a reason, it will also be logged in the description. It should look something like this:

Event Type: Information Event Source: USER32 Event Category: None Event ID: 1074 Date: 12/14/2005 Time: 1:31:52 PM User: Computer: Description: The process winlogon.exe has initiated the restart of computer on behalf of user for the following reason: No title for this reason could be found Reason Code: 0x800000ff Shutdown Type: restart Comment:

S.T.A.L.K.E.R.
  • 474
  • 2
  • 4
1

Have you tried Control Panel > Administrative Tools > Event Viewer?

zildjohn01
  • 2,337
  • I just did and I see nothing. More to the precisely, I see 1000s of unrelated things and there doesn't even appear to be a way to search. I will check the c:\ drive next though. – MatthewMartin Aug 24 '10 at 20:27
1

A list of shutdown reasons can be found in this MSDN article "System Shutdown Reason Codes". The reasons mentioned there are added to the event description after "the following reason: ". This is also the place where you will find user-initiated restarts and their reasons.

As other users already mentioned, you can find these events in the event viewer. Filter for eventid 1074.

Abel
  • 1,473