Windows Server is a system developed by Microsoft for corporate environments which gives us a series of useful and functional options to control , manage, assign and carry out a large number of tasks within the company with the best performance and current roles..
As IT administrators and general system personnel, we know the importance of the availability of a server since it will depend on various processes and functions to which many users and equipment are linked and if the server were turned off everything would be affected incurring various errors and failures.
For our help, Windows Server has a function called Shutdown Events, Shutdown Event Tracker, through which we will have the opportunity to keep track of each associated event during system shutdown or reboot, to achieve this control this function is responsible for create an entry in the Windows Event Viewer which we can access for your query, it is also a fundamental tool to determine causes of shutdown that have not been programmed..
1. Turn off Windows Server 2019, 2016
Step 1
Currently, when we turn off Windows Server 2016 or 2019, we must select some reason why this process will take place:
Step 2
Previously, it was necessary to assign a more complete reason for said shutdown, restart or logout, this will still be possible using the following keys and the following box will be displayed where we will indicate the action to be performed and the cause of said action:
+ F4 Alt + F4
Step 3
There we proceed to shut down or restart the computer. With this tutorial TechnoWikis wants to explain in depth how to access these types of events so that our management tasks are much more complete.
2. Access and use event viewer in Windows Server 2019, 2016
Step 1
For this case we will use Windows Server 2019 and to access this event viewer we have the following options:
- Use the following key combination and execute the eventvwr command and press Enter or Accept
+ R
eventvwr
- Go to the Server Manager and there go to the path "Tools / Event Viewer".
Step 2
In the displayed window we will go to the following route:
Step 3
There we find a complete summary of all the events that have occurred in Windows Server 2019 indicating details such as:
Step 2
Now, we are going to filter the results displayed using one of the following options:
- Click on the “Filter current record†line located on the right side.
- Right click on System and select "Filter current record".
- Go to the "Action" menu and select "Filter current record".
Step 3
The following window will be displayed where we will enter the following event IDs in the respective field:
1074 and 1076
Step 4
ID 1074 indicates that the shutdown or restart of Windows Server 2016 or 2019 has been controlled and known, these are of USER32 origin. ID 1076 indicates events that have happened unexpectedly on the server. In the event viewer window we can specify a range of dates or specify a specific user or team. Click on the "Accept" button and this will be the result obtained:
Step 5
There we have each of the events filtered according to our request. By double clicking on any of the events we access much more complete information about it. In the case of ID 1074, as we have restarted with a comment, we will see the following:
Step 6
There is indicated the type of shutdown and the comment that we have entered as well as the date and time of it. In the case of ID 1076, the scenario will be as follows:
Step 7
We can see that it was an unplanned event. The options available in the shutdown type are:
Planned
It is a shutdown or restart defined and known to us.
Non-planned
It is an unexpected shutdown or restart.
Unexpected planning
It is a shutdown using the power button, also called emergency shutdown. It is considered a planned shutdown.
Unexpected unplanned
It is an unexpected and sudden shutdown that the system does not keep in mind, for example, when we disconnect or the power goes out.
We have learned the simple way that Windows Server 2016 or 2019 offers us to manage the shutdowns on it.