Find Who Restarted Windows Server
--Run the following command to filter the System Logs with Source as User32.
Get-EventLog -LogName System | Where Source -eq User32
--You may also filter the system logs with Event ID 1074 with the following command.
Get-EventLog -LogName System | Where EventID -eq 1074
No comments:
Post a Comment
If you have any doubt or question, please contact us.