Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Where can I find the shutdown reason notes for Windows Server 2003?

I sometimes fill these in, but I never see them again.

share|improve this question

3 Answers 3

up vote 3 down vote accepted

Shutdowns events are located in the System Event log (Event 1074).

You can filter for Source: USER32 If your running windows 2003 and specify a reason, it will also be logged in the description. It should look something like this:

Event Type: Information Event Source: USER32 Event Category: None Event ID: 1074 Date: 12/14/2005 Time: 1:31:52 PM User: Computer: Description: The process winlogon.exe has initiated the restart of computer on behalf of user for the following reason: No title for this reason could be found Reason Code: 0x800000ff Shutdown Type: restart Comment:

share|improve this answer

Have you tried Control Panel > Administrative Tools > Event Viewer?

share|improve this answer
    
I just did and I see nothing. More to the precisely, I see 1000s of unrelated things and there doesn't even appear to be a way to search. I will check the c:\ drive next though. –  MatthewMartin Aug 24 '10 at 20:27

A list of shutdown reasons can be found in this MSDN article "System Shutdown Reason Codes". The reasons mentioned there are added to the event description after "the following reason: ". This is also the place where you will find user-initiated restarts and their reasons.

As other users already mentioned, you can find these events in the event viewer. Filter for eventid 1074.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.