To See What user Turned off Server follow the following steps:
Sometimes a server may go down and you want to determine what user shut it off. It may be in the case of a Remoted Desktop Server where you allow users to have the ability to shut down the server. If this happens you may need to find out What user Turned off Server?
1. Go to Event Viewer
2. Expand Windows Logs and then click on System and on the right side, click -> Filter Current Log
3. For User Shutdowns, click downward arrow of Event Sources -> Check User32.
4. In <All Event IDs> type 1074 -> OK
This will give the list of Power off and restart events. It will have the date and time as well as Username.