Why Windows has been restarted?

Sometimes some of our Windows servers restarts by itselfs and we usually think this could be related with the windows update services. Sometimes even we tend to believe it without check it in the server… sometimes because we are more the Linux/Unix guys or whatever.

But the fact is that is quite simple to know what rebooted a Windows server, so let’s check it.

First of all we have to open the event viewer. In start menu just search for “Event Viewer”

Once opened, in the left panel of Event Viewer, open Windows Logs and System, right click or press and hold on System, and click/tap on Filter Current Log.

Put this event IDs (1074, 6006, 6008) below into the field, and click on OK

Now you can view the details of these shutdown event logs filtered by these event IDs

In this example, the update of the vmware-tools was the reason for the server restart.