Why Did My Windows Server Restart? | Step-By-Step Guide
Microsoft Article:
https://learn.microsoft.com/en-us/tro...
Event IDs:
12, 13, 41, 42, 109, 1074, 1076, 4609, 4616, 6005, 6006, 6008, 6013
Ever had your Windows Server just restart out of nowhere? In this video I go through how I check the Event Viewer to figure out what actually caused the reboot.
To force a crash I will be using a SysInternal tool called NotMyFault.
I’ll show you the most useful event IDs for shutdowns and restarts:
12 / 13 (OS start and stop)
41 (Kernel-Power – unexpected restart / crash)
1074 (restart triggered by user or process)
1076 (unplanned shutdown reason code)
6008 (previous shutdown was unexpected)
6005 / 6006 (system startup and shutdown)
This works the same on Windows Server 2016, 2019, 2022 and even Windows 10/11.
Great if you’re a sysadmin or IT admin trying to track down random reboots.
If you find this useful, hit subscribe — I post more sysadmin tips, Windows Server tricks, SQL Server, and networking stuff here.
Timestamps
0:00 Intro
0:20 Crash App NotMyFault
2:12 Filter Logs in Event Viewer
4:45 Logs from a Clean Restart
#WindowsServer #UnexpectedReboot #EventViewer #SysAdmin #ServerRestart