Where can I find the shutdown reason notes for Windows Server 2003?

I sometimes fill these in, but I never see them again.

3 Answers 3


Shutdowns events are located in the System Event log (Event 1074).

You can filter for Source: USER32 If your running windows 2003 and specify a reason, it will also be logged in the description. It should look something like this:

Event Type: Information Event Source: USER32 Event Category: None Event ID: 1074 Date: 12/14/2005 Time: 1:31:52 PM User: Computer: Description: The process winlogon.exe has initiated the restart of computer on behalf of user for the following reason: No title for this reason could be found Reason Code: 0x800000ff Shutdown Type: restart Comment:


Have you tried Control Panel > Administrative Tools > Event Viewer?

  • I just did and I see nothing. More to the precisely, I see 1000s of unrelated things and there doesn't even appear to be a way to search. I will check the c:\ drive next though. Aug 24, 2010 at 20:27

A list of shutdown reasons can be found in this MSDN article "System Shutdown Reason Codes". The reasons mentioned there are added to the event description after "the following reason: ". This is also the place where you will find user-initiated restarts and their reasons.

As other users already mentioned, you can find these events in the event viewer. Filter for eventid 1074.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .