.. coming from a fairly new Sys Admin of Windows VMs/Servers but with 20+ years of IT experience, I never needed this before… and my initial searches were only giving me the event ID showing when a server rebooted, not by whom. In this post I will show you the steps to find out who restart Windows Server. If you try it and find that it works on another platform, please add a note to the script discussion to let others know. How To Restart Computers Remotely via PowerShell.

How to find out who restarted Windows Server To find out who restarted windows server :- Login to Windows Server. So how do you find who restarted Windows Server ?.Yes there is a way to do that.

Make sure to back up your code. Sign up here to get the latest posts delivered directly to your inbox.You can unsubscribe at any time.

Of course It also gathers the reason why the users restarted or shutdown the computer. Reboot I guess that all of the server administrators had this situation when server was not responding. More info about it is documented The process C:\Windows\System32\RuntimeBroker.exe (CORPAD) has initiated the restart of computer CORPAD on behalf of user PRAJWAL\sccmadmin for the following reason: Other (Unplanned)Hi, I am Prajwal Desai.

Powershell script to check Last Reboot Time on a list of machines included in a text file and export the report as a CSV file.##### ... Windows Server 2012 Yes Windows Server 2012 R2 PowerShell provides an easy way to accomplish this with the Get-WMIObject commandlet. Ensuring the servers are up and working fine is the duty of system administrators.Sometimes things don’t go well. This post will come handy if you looking to find who restarted windows server. We'll assume you're ok with this, but you can opt-out if you wish. Thank you! Get Windows Server's last Reboot Log | EventID:1074 This script can be used to read event logs from list of Windows servers written in Servers.txt and read their System event logs and find event id: 1074 which contains The reason/message supplied during restart/shutdown of any Windows server and display them in Grid view format, Launch the Event Viewer (type eventvwr in run). The trick is easy with the aptly named Restart-Computer . I will show you how to get both the last boot time as well as the current up time for a computer.

001 002 003 004 005 006 007 008 009 010 011 012 013 014 015 016 017 018 019 020 021 022 023 024 025 026 027 028 I will also illustrate using a function to determine any computer’s up time remotely. Prof. Powershell. For last few years I have been working on multiple technologies such as SCCM / Configuration Manager, Intune, Azure, Security etc. Posted on March 16, 2017 December 24, 2017 by Pawel Janowicz. Get-Uptime and Last Reboot Status For Multiple Computers With Powershell Posted on July 21, 2018 by Paul If you’re on a single machine and want to check when the last time a computer rebooted, you would use the systeminfo command and search for the System Boot Time property of that command. If you are working for a big organization, you might have lot of Windows servers in your setup. Is there any configuration that needs to be done that can help get the actual user who restarted the Application server.This article helped me today.. By continuing to browse this site, you agree to this use.Powershell script to check Last Reboot Time on a list of machines in a text file This site uses cookies for analytics, personalized content and ads. The Restart-Computer cmdlet restarts the operating system on the local and remote computers.You can use the parameters of Restart-Computer to run the restart operations, to specify theauthentication levels and alternate credentials, to limit the operations that run at the same time,and to force an immediate restart.Starting in Windows PowerShell 3.0, you can wait for the restart to complete before you run the nextcommand.

This website uses cookies to improve your experience. By Jeffery Hicks; 04/10/2012; It is a fact that Windows administrators periodically need to reboot servers and desktops. It is likely to work on other platforms as well.

This script is tested on these platforms by the author. For validation purpose, I tried to restart my laptop, but there user is shown : SYSTEM, although it should actual user name who restarted the server. Suppose you get an email saying that a server has been restarted and this needs to be investigated.You cannot ask each IT individual about who initiated the server restart. It is kind of you to provide this valuable information.Hi, I did not get the User who restarted the Application server. We are retiring the TechNet Gallery. Fake email addresses will be deleted.Prajwal Desai - SCCM | ConfigMgr | Server | Azure | Intune | Software Disable Server Manager at Startup Using Group Policy Understand Hard Disk Volume Status and Descriptions Deploy Windows 7 Using MDT (Microsoft Deployment Toolkit) Import Captured WIM file into MDT (Microsoft Deployment Toolkit) Reboot server remotely via PowerShell. If you don’t have access to iDRAC, iLO .etc the only way to fix the issue will be rebooting server remotely. I created this site so that I can share valuable information with everyone.Thank you, Prajwal.