Open the System log and Filter your view. Category Logon/Logoff Comments You must be logged in to comment home| search| account| evlog| eventreader| it admin tasks| tcp/ip ports| documents | contributors| about us Event ID/Source search Event How do I catch a Ditto? Help Desk » Inventory » Monitor » Community » Toggle navigation MyEventlog Home Browse Submit Event Log Resources Blog Quiz Event Search Event ID Source Category Message EventSentry Real-Time Event Log this contact form
Sample: Event Type: Information Event Source: EventLog Event Category: None Event ID: 6009 Date: 10/16/2009 Time: 18:09:48 User: Computer: MACHINENAME Description: Microsoft (R) Windows (R) 5.02. 3790 Service Pack 2 Uniprocessor So normally look for this pattern. 6009 and 6005 same time stamp, system just started. 6013 - system has been up for a day or more, time in seconds. 6006 - Thanks Mike 4608-startup.jpg event-12-startup.jpg 0 Featured Post What Security Threats Are You Missing? thanks in advance, Rustum Sponsored Links 28-08-2007, 04:02 AM #2 jlm Guest Posts: n/a RE: Server 2003 restart log check the event log.
Likely a 6008 or 6009 event. > > > > > > "Rustum" wrote: > > > > > > > Hi all, > > > > > > > > share|improve this answer answered Jun 25 '12 at 10:31 squillman 33.4k870127 add a comment| Your Answer draft saved draft discarded Sign up or log in Sign up using Google Sign event ID 1074 from USER32 will show you who/why the system was shutdown. 7 Sonora OP hb-Soundy Feb 25, 2014 at 5:02 UTC lol.. Email: Name / Alias: Hide Name Solution Your solution: * Additional Links Name: URL:
Hope this helps! "Rustum" wrote: > Thanks for the Reply jlm, > the event 6008 gives info only about unexpexcted shutdown, i want to find if > some other administrator initiated See MSW2KDB for additional information about this event. Cutting my kid loose from my PS account? Event Id 1074 Would my paper be published if I missed the conference due to visa-related problems?
EventID 6008 - The previous system shutdown at %1 on %2 was unexpected. Windows Event Id 6005 See example of private comment Links: ME196452, ME227438, MSW2KDB Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (2) - More links... Creating your account only takes a few minutes. a fantastic read Source Security Type Warning, Information, Error, Success, Failure, etc.
All Rights Reserved - PrivacyPolicy Event Id For Server Reboot Join them; it only takes a minute: Sign up Here's how it works: Anybody can ask a question Anybody can answer The best answers are voted up and rise to the The Source is: EventLog. How would a "reversed planet" be able to exist?
Connect with top rated Experts 21 Experts available now in Live! Likely a 6008 or 6009 event. > > > > > > "Rustum" wrote: > > > > > > > Hi all, > > > > > > > > Promoted by Recorded Future Enhance your security with threat intelligence from the web. navigate here First Name Please enter a first name Last Name Please enter a last name Email We will never share this with anyone.
Login here! Event 6008 Likely a 6008 or 6009 event. "Rustum" wrote: > Hi all, > > Is there any log in Windows Server 2003 through which I can find why my > server restarted Computer DC1 EventID Numerical ID of event.
Event 6005 Event Log Service has started Or Event 6009 with info about the OS build, service peck level, etc. Thanks. 0 Comment Question by:Senior IT System Engineer Facebook Twitter LinkedIn Email https://www.experts-exchange.com/questions/27411265/Windows-Server-Event-ID-for-system-shutdown-and-restart.htmlcopy LVL 57 Best Solution byMike Kline Look for event 4608 in your security logs http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4608 Attached an example The details for this event will tell you what process initiated the restart and what reason was given, and you can check the reason code for further information about why the http://seforum.net/event-id/event-id-2003-windows-xp.html Description Special privileges assigned to new logon.
Need Help? Can you guide me which word should i find for finding Start up or boot time Thanks & Regards, Param Reply Subscribe RELATED TOPICS: Event ID: 6006 Source: Microsoft-Windows-Winlogon VLANs and From what I've briefly read, 6009 occurs when CTRL-ALT-DEL or Start > Shutdown is initiated by a user.