🖥️ How to Check Windows Server Restart History Using PowerShell

Knowing when a Windows Server was restarted, who initiated the reboot and whether the shutdown was unexpected is extremely important for server management and troubleshooting.

System administrators, IT teams and even general users often need to track Windows restart history for maintenance, uptime monitoring and issue investigation.

In this guide, you will learn how to:

• Check Windows Server reboot history
• Find out who restarted the server
• Detect unexpected shutdowns
• Identify the process responsible for the reboot
• Analyze Windows Event Logs using PowerShell

📌 PowerShell Command to Check Restart History

Use the following PowerShell command to retrieve Windows reboot and shutdown logs:

Get-WinEvent -FilterHashtable @{
    LogName='System'
    ID=1074,6006,6008,41
} | Select-Object TimeCreated, Id,
@{Name="User";Expression={$_.Properties[6].Value}},
@{Name="Process";Expression={$_.Properties[0].Value}},
Message | Sort-Object TimeCreated -Descending
        

📌 What Does This Command Do?

📌 Event ID Meanings

📌 Example Output

TimeCreated         Id    User            Process
-----------         ---   -----           --------
05/26/2026 01:15    1074  Administrator   shutdown.exe
05/26/2026 01:14    6006
05/26/2026 01:13    6008
05/26/2026 01:13    41
        

In this example:

• The server was restarted.
• The reboot was initiated by the Administrator user.
• The process responsible was shutdown.exe.
• An unexpected shutdown occurred previously.

📌 Why Monitoring Windows Restart History Is Important

• Track server uptime and downtime
• Detect unauthorized reboots
• Investigate unexpected shutdowns
• Identify power outages or crashes
• Review maintenance activities
• Troubleshoot server stability issues
• Monitor Windows Server health

📌 How to Open PowerShell

1. Click the Start Menu
2. Type PowerShell
3. Right-click Windows PowerShell
4. Select “Run as Administrator”
5. Paste the command and press Enter

✅ Conclusion

Using PowerShell to check Windows Server restart history is a quick and effective way to monitor reboot activities, detect unexpected shutdowns and identify who restarted the system.

This method is especially useful for Windows Server administrators who need better visibility into server uptime, maintenance and troubleshooting processes.