What User Turned off Server?

To See What user Turned off Server follow the following steps:

Sometimes a server may go down and you want to determine what user shut it off. It may be in the case of a Remoted Desktop Server where you allow users to have the ability to shut down the server. If this happens you may need to find out What user Turned off Server?

1. Go to Event Viewer

2. Expand Windows Logs and then click on System and on the right side, click  -> Filter Current Log

Event Viewer

3. For User Shutdowns, click downward arrow of Event Sources -> Check User32.

4. In <All Event IDs> type  1074 -> OK

Event Viewer Filter

This will give the list of Power off and restart events. It will have the date and time as well as Username.

Event Viewer Results

Leave a Reply

Your email address will not be published. Required fields are marked *