Can the restart queries one is asked about when a server is rebooted be retrieved?  If so, how?

Posted on 2014-08-03
Medium Priority
Last Modified: 2014-08-30
Every time a server is rebooted, a dialogue box asks for a reason.  Is there a way to review these?
Question by:Still Learning
LVL 60

Assisted Solution

by:Cliff Galiher
Cliff Galiher earned 268 total points
ID: 40238217
The restart and the reason is recorded in the system event log. You can simply open the event viewer and filter on event ID.

Author Comment

by:Still Learning
ID: 40238233
Cliff, you are technically correct, and if that is the only place they are recorded I'm no closer than I thought I was and will end up giving you the points just for being helpful.  I was hoping there was a more precise way built in.  For instance, on one server I just looked at as an example, I have four different Event ID's that I would have to filter through when I searched through events for "reboot" - and I might have missed a few at that.  I was hoping... but thank you for responding so quickly!
LVL 25

Assisted Solution

by:Mohammed Khawaja
Mohammed Khawaja earned 264 total points
ID: 40238710
Powershell can do it for you.  Below are tow links which I used in the past but now I don't use as I use SolarWinds:


Easiest way too know if server rebooted is to look for Event Log start

Accepted Solution

Sitaram Pamarthi earned 268 total points
ID: 40238947
AFAIK, event log is the only source to find such information. But instead of searching for the word reboot, I prefer you look for events from the source "USER32". The events from this source contains information related to the reboot. If it is user initiated reboot, you will see the reason specified there(what ever you enter at shutdown tracker window). In case of Crash reboots, the server will prompt for entering the reboot after the first user logins to the server. This is also recorded in the events with the source "USER32".

Refer these for more information:


Author Closing Comment

by:Still Learning
ID: 40294914
Thanks to all three of you for your responses - my apologies for not getting this closed sooner.  All three of you were completely correct - Cliff was quick, Sitaram's answer included probably the simpler, more direct way to reach the answer.  I love Power Shell so that is probably the one but not everyone would agree.  All in all, I just can't divide my measly 200 equally by 3 without a decimal, and I don't think we can use decimal in awarding points.  In the end, I found myself thinking too hard so I had to go somewhere... thank you so much for taking the time to help me out here!  Hopefully this will help someone else out, too!

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Resolve DNS query failed errors for Exchange
OfficeMate Freezes on login or does not load after login credentials are input.
This tutorial will walk an individual through the process of configuring basic necessities in order to use the 2010 version of Data Protection Manager. These include storage, agents, and protection jobs. Launch Data Protection Manager from the deskt…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
Suggested Courses

862 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question