Event ID 1074: A process initiated a restart or shutdown

Written when a user or process asks Windows to restart or shut down, with the reason given.

Log: System
Category: System

Why it matters

Shows who restarted a machine. Ransomware and some installers force restarts.

What to check

Check the process, the user and the reason code.

How to turn it on

Logged by default.