How to find out who restarted Windows Server
In the event viewer console expand Windows Logs.
Click System and in the right pane click Filter Current Log
In the Filter Current log box, type 1074 as the event ID
In the event viewer console expand Windows Logs.
Click System and in the right pane click Filter Current Log
In the Filter Current log box, type 1074 as the event ID