A process initiated a restart or shutdown

What it means

Records who or what restarted the computer, and the reason given.

Why it matters

Answers "who rebooted the server?" — a user, Windows Update, or an application.

What to do

• Read the process and user fields to find the initiator.

Find it with PowerShell

Get-WinEvent -MaxEvents 20 -FilterHashtable @{
  LogName = 'System'; Id = 1074
} | Select-Object TimeCreated, ProviderName, Message

Add -ComputerName SERVER to query another machine. Other event sources can reuse the same ID number, so check the ProviderName column.