As administrators of Windows Server 2022 we must be attentive to many changes and situations that happen on the server, from verifying roles and characteristics to unauthorized access attempts, this can be complex but we have functional tools to better control this..
We know very well that Windows Server 2022 (and in any edition) cannot be shut down just because yes, a shutdown implies leaving down all server functions and resources for the computers in the domain. Therefore, if the server has been shut down without our consent, TechnoWikis will explain how to view the shutdown-only events to know who, when and why it happened.
To stay up to date, remember to subscribe to our YouTube channel! SUBSCRIBE
How to view shutdown events in Windows Server 2022
Step 1
First of all we turn off the system and it invites us to select some cause of why we are turning it off:
Step 2
After selecting the option the server will shut down:
Step 3
Now, when it turns on and you log in again, let's open the Event Viewer using one of the following options:
- Use the following command and key combination:
Ctrl + R
eventvwr
- From the Server Manager in the path "Tools / Event Viewer"
Step 4
The console will open and there we will go to the Windows Records - System path:
Step 5
This will list all the system events with details like:
Step 6
To see only the shutdown events we must apply a filter, for this we have the following options:
- Click on the line "Filter current record" on the right side.
- From the menu "Action" and there select "Filter current record"
- Right click on System and select "Filter current record".
Step 7
In the Event IDs field we enter the codes 1074 and 1076:
Step 8
The ID 1074 indicates that the shutdown or restart of Windows Server 2022 was on purpose due to some administrative or management task, this is associated with USER32.
The ID 1076 indicates events that have happened unexpectedly on the server due to a power failure, system errors, etc..
We click OK to apply the filter and list only these events:
Step 9
At the bottom we find a summary, but it is possible to double click on an event to access more specific details:
Step 10
The shutdown options are:
- Planned - This is an administrator defined shutdown or reboot
- Unplanned: as the name implies, it is a shutdown or reboot for no valid reason
- Unexpected planning - This is a power button shutdown, also known as an emergency shutdown. It is considered a planned shutdown.
- Unexpected unplanned - This is an unscheduled shutdown or reboot
It's that simple to view shutdown events in Windows Server 2022.