[ This Blog Was Moved To : http://www.diknows.com ]
Recently I Needed to know when was the Windows Server Machine restarted and Why ?
So, I executed the command in CMD
net statistics server
- The Start up time is : Statistics since 8/16/2009 5:40 AM
- Then From Event Viewer I sorted System Logs by Source
- Searched for User32 and matched Date with the output of `net statistics server` to know the cause of system restart.
- With a double click on the record, I found something like that
The process winlogon.exe has initiated the restart of computer APPLICATION0 on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found Reason Code: 0x80020002 Shutdown Type: restart Comment: For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
- Now, I Could figure out that User NT AUTHORITY\SYSTEM Has initiated a restart intintionally.
Thats All Admins.
