Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Where can I find the shutdown reason notes for Windows Server 2003?

I sometimes fill these in, but I never see them again.

share|improve this question
up vote 3 down vote accepted

Shutdowns events are located in the System Event log (Event 1074).

You can filter for Source: USER32 If your running windows 2003 and specify a reason, it will also be logged in the description. It should look something like this:

Event Type: Information Event Source: USER32 Event Category: None Event ID: 1074 Date: 12/14/2005 Time: 1:31:52 PM User: Computer: Description: The process winlogon.exe has initiated the restart of computer on behalf of user for the following reason: No title for this reason could be found Reason Code: 0x800000ff Shutdown Type: restart Comment:

share|improve this answer

Have you tried Control Panel > Administrative Tools > Event Viewer?

share|improve this answer
I just did and I see nothing. More to the precisely, I see 1000s of unrelated things and there doesn't even appear to be a way to search. I will check the c:\ drive next though. – MatthewMartin Aug 24 '10 at 20:27

A list of shutdown reasons can be found in this MSDN article "System Shutdown Reason Codes". The reasons mentioned there are added to the event description after "the following reason: ". This is also the place where you will find user-initiated restarts and their reasons.

As other users already mentioned, you can find these events in the event viewer. Filter for eventid 1074.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .