• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 294
  • Last Modified:

OS Restart Audit ???

A few windows services that i started yesterday seem to have shut down today. My guess is that the machine was restarted. Is there a way i can verify from some log if the machine was restarted manuallly or automatically after say some patches were deployed?
1 Solution
Head into the System log of the server and look for event ID 6006, source EventLog. Work backwards from there to see why the shutdown occurred (if i was scheduled) and forward if it wasn't ( it'll leave evidence).


Featured Post

Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now