A forced restart to load a driver or a persistence mechanism.
What gives it awayA restart via shutdown.exe by an account that does not administer that machine, particularly after a service or driver installation.
ATT&CK T1529Windows System Log · Event 1074
Event 1074: Something asked Windows to shut down or restart
A deliberate shutdown or restart was requested, and Windows recorded which program asked, which account it ran as, and the reason given. It is the event that answers the question 'who rebooted this machine'.
Also written as 1074Event ID 1074who restarted the server
- How oftenFires regularly
- Vendor calls itInformation
- LogSystem
- SourceUser32
What it means for you
On a personal computer
Your PC was shut down or restarted on purpose. The message says which program asked — usually Windows Update or you clicking restart.
For an analyst
The first place to look when a server rebooted unexpectedly, because it distinguishes a deliberate restart from a crash immediately. If there is no 1074 and you have a 6008, nobody asked; the machine went down on its own.
What it looks like
Sanitised. Addresses come from the RFC 5737 documentation ranges.
The process C:\Windows\System32\shutdown.exe (SRV-APP01) has initiated the restart of computer SRV-APP01 on behalf of user CORP\jbrooks-adm for the following reason: Operating System: Reconfiguration (Planned)
Reason Code: 0x80020004
Shutdown Type: restart
Comment: Post-patch rebootThe fields that decide it
Everything else in the log line is context.
- Process
- The program that requested it.
-
C:\Windows\System32\svchost.exeUsually Windows Update installing patches. -
C:\Windows\System32\shutdown.exeSomeone ran the shutdown command, locally or remotely. -
C:\Windows\Explorer.EXESomeone used the Start menu. -
C:\Windows\System32\RuntimeBroker.exeA modern app requested it, typically through the power menu. - User
- The account that requested it. A remote shutdown shows the account that issued it.
- Reason
- The shutdown reason code and its description, where one was supplied.
- Shutdown Type
- Whether it was a shutdown, a restart, or a power off.
- Comment
- Free text supplied with the request, which scripted shutdowns often use.
Ordinary reasons this happens
Most of the time it is one of these.
- Windows Update restarting to finish installing patches.
- A user choosing Restart or Shut Down.
- Scheduled maintenance scripts restarting a machine.
- Management tooling restarting after a software deployment.
- An administrator running shutdown remotely.
When it is not ordinary
Disruption of a production system.
What gives it awayRepeated deliberate restarts of a server with no matching change record.
ATT&CK T1529What to do next
- Read the process name — it distinguishes Windows Update from a person from a script immediately.
- Read the user. That is who asked.
- Check for a preceding service or driver installation if the restart was not scheduled.
- Compare against your patching schedule before treating it as unusual.
- If there is no 1074 for a restart you are investigating, look for 6008 and 41 instead — nothing asked, so the machine went down on its own.
Queries to run
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 20 | Select-Object TimeCreated, Message | Format-ListEvent | where EventLog == 'System' and EventID == 1074 | project TimeGenerated, Computer, RenderedDescription | order by TimeGenerated descCommon questions
How do I find out who restarted a Windows server?
Look for Event 1074 in the System log. It names the process that made the request, the account it ran under, and any comment supplied. If there is no 1074 around the time of the restart, nobody asked for it — check Events 6008 and 41 instead, which cover unexpected shutdowns.
Why does Event 1074 show svchost.exe as the process?
Because Windows Update requested the restart to finish installing patches. Windows Update runs inside a shared service host process, so it appears as svchost.exe rather than under its own name. The reason code in the message usually confirms it.
Read next
- Usually comes after Event 6006: The event log service stopped The event log service stopping, which confirms the shutdown proceeded cleanly.
- Usually comes after Event 6005: The event log service started The event log service starting on the next boot.
- The equivalent of Event 6008: The previous system shutdown was unexpected An unexpected shutdown. The absence of a 1074 is what makes it unexpected.
- The equivalent of Event 41: The system rebooted without shutting down cleanly The unclean shutdown record, when nothing requested the restart.
Mentioned by
Vendor documentation
Last reviewed 28 August 2026