Why Did My Windows Server Restart? | Step-By-Step Guide
Microsoft Article:
https://learn.microsoft.com/en-us/tro...
Event IDs:
12, 13, 41, 42, 109, 1074, 1076, 4609, 4616, 6005, 6006, 6008, 6013
Ever had your Windows Server just restart out of nowhere? In this video I go through how I check the Event Viewer to figure out what actually caused the reboot.
To force a crash I will be using a SysInternal tool called NotMyFault.
I’ll show you the most useful event IDs for shutdowns and restarts:
12 / 13 (OS start and stop)
41 (Kernel-Power – unexpected restart / crash)
1074 (restart triggered by user or process)
1076 (unplanned shutdown reason code)
6008 (previous shutdown was unexpected)
6005 / 6006 (system startup and shutdown)
This works the same on Windows Server 2016, 2019, 2022 and even Windows 10/11.
Great if you’re a sysadmin or IT admin trying to track down random reboots.
If you find this useful, hit subscribe — I post more sysadmin tips, Windows Server tricks, SQL Server, and networking stuff here.
Timestamps
0:00 Intro
0:20 Crash App NotMyFault
2:12 Filter Logs in Event Viewer
4:45 Logs from a Clean Restart
#WindowsServer #UnexpectedReboot #EventViewer #SysAdmin #ServerRestart
On this page of the site you can watch the video online Why Did My Windows Server Restart? | Step-By-Step Guide with a duration of hours minute second in good quality, which was uploaded by the user The Swedish Sysadmin 06 October 2025, share the link with friends and acquaintances, this video has already been watched 573 times on youtube and it was liked by 6 viewers. Enjoy your viewing!
