{"id":8026,"date":"2021-11-22T17:52:49","date_gmt":"2021-11-22T16:52:49","guid":{"rendered":"https:\/\/michlstechblog.info\/blog\/?p=8026"},"modified":"2021-11-23T06:58:23","modified_gmt":"2021-11-23T05:58:23","slug":"windows-determine-who-and-why-shuts-down-windows","status":"publish","type":"post","link":"https:\/\/michlstechblog.info\/blog\/windows-determine-who-and-why-shuts-down-windows\/","title":{"rendered":"Windows: Determine who and why shuts down Windows"},"content":{"rendered":"<div class=\"twoclick_social_bookmarks_post_8026 social_share_privacy clearfix 1.6.4 locale-en_US sprite-en_US\"><\/div><div class=\"twoclick-js\"><script type=\"text\/javascript\">\/* <![CDATA[ *\/\njQuery(document).ready(function($){if($('.twoclick_social_bookmarks_post_8026')){$('.twoclick_social_bookmarks_post_8026').socialSharePrivacy({\"services\":{\"flattr\":{\"uid\":\"Michl\",\"status\":\"on\",\"the_title\":\"Windows%3A%20Determine%20who%20and%20why%20shuts%20down%20Windows\",\"the_excerpt\":\"Hi%2C%0D%0A%0D%0Ato%20determine%20who%20shuts%20down%20Windows%20the%20system%20log%20can%20be%20filtered%20for%20the%20Event%20Id%201074%20%28Source%20User32%29.%0D%0A%20%28more%26hellip%3B%29\",\"txt_info\":\"2 clicks for more data protection:\\r\\n\\r\\nOnly when you click here, the button will be come active and you can send your recommendation to Flattr. When activating, data are transmitted to third parties. \",\"perma_option\":\"off\"}},\"txt_help\":\"When you activate these fields by clicking, information to Flattr may be transferred abroad, and probably may also stored there.\",\"settings_perma\":\"Enable permanently and accept data transmission. \",\"info_link\":\"http:\\\/\\\/www.heise.de\\\/ct\\\/artikel\\\/2-Klicks-fuer-mehr-Datenschutz-1333879.html\",\"uri\":\"https:\\\/\\\/michlstechblog.info\\\/blog\\\/windows-determine-who-and-why-shuts-down-windows\\\/\",\"post_id\":8026,\"post_title_referrer_track\":\"Windows%3A+Determine+who+and+why+shuts+down+Windows\",\"display_infobox\":\"on\"});}});\n\/* ]]> *\/<\/script><\/div><p>Hi,<\/p>\n<p>to determine who shuts down Windows the system log can be filtered for the Event Id 1074 (Source User32).<br \/>\n<!--more--><br \/>\nThese entries contains the Username, the process that triggers the shutdown and the given reason.<\/p>\n<pre class=\"brush: powershell; title: ; notranslate\" title=\"\">\r\nPS D:\\&gt; Get-WinEvent -Logname System | ?{$_.Id -eq 1074} | Format-List TimeCreated,Message\r\nTimeCreated : 22.11.2021 16:44:31\r\nMessage     : The process C:\\Windows\\system32\\svchost.exe (myComputer) has initiated the restart of computer\r\n              myComputer on behalf of user NT AUTHORITY\\SYSTEM for the following reason: Operating System: Service\r\n              pack (Planned)\r\n               Reason Code: 0x80020010\r\n               Shutdown Type: restart\r\n               Comment:\r\n<\/pre>\n<p>Michael<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hi, to determine who shuts down Windows the system log can be filtered for the Event Id 1074 (Source User32).<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[853,1688,1686,993,1687,20],"class_list":["post-8026","post","type-post","status-publish","format-standard","hentry","category-windowsknowhow","tag-determine","tag-reason","tag-recognize","tag-shutdown","tag-who","tag-windows-2"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts\/8026","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/comments?post=8026"}],"version-history":[{"count":1,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts\/8026\/revisions"}],"predecessor-version":[{"id":8027,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts\/8026\/revisions\/8027"}],"wp:attachment":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/media?parent=8026"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/categories?post=8026"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/tags?post=8026"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}