Dear All,
I need some help regarding windows server 2003 Logs. My server got restarted automatically, i see the following in system logs.
Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 6/24/2014
Time: 2:11:15 PM
User: NSH\Administrator
Computer: NEURODC
Description:
The process Explorer.EXE has initiated the shutdown of computer NEURODC on behalf of user NSH\Administrator for the following reason: Security issue
Reason Code: 0x84050013
Shutdown Type: shutdown
Comment:
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/even…
Data:
0000: 13 00 05 84
No it didn’t. Whoever was logged on as Administrator at the time rebooted it.
Check the Security log. If there was a real security issue, it should list the issue there.
How To Ask Questions The Smart Way
message edited by Razor2.3
View shutdown and restart events from Event Viewer
In Event Viewer, select Windows Logs > System from the left pane. From the right, click on the Filter Current Log link. Type in 41,1074,6006,6008 into the box below Includes/Exclude Event IDs… Hit Ok. Windows then displays all shutdown-related events.
Steps to see which user shutdown the system:
Go to event Viewer.
Right click on system and -> Filter Current Log.
For User Shutdowns, click downward arrow of Event Sources -> Check User32.
In type 1074 -> OK.