Windows Server / Services, IIS & Secure Operations
Correlate a Windows Server restart with actual event evidence
A recent boot time does not explain whether a restart was planned, forced or caused by a crash. Collect a bounded event set.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,1074,6005,6006,6008; StartTime=(Get-Date).AddDays(-2)} -MaxEvents 100Read the result
The events provide different startup, shutdown and unexpected-restart signals. Their presence must be correlated by time rather than treated as one universal cause.
Resolve and verify
Compare administrator changes, update orchestration, crash dumps and hypervisor or hardware logs. Correct the demonstrated cause and verify the server's recovery path.
Before changing production
Do not assume a power event alone proves hardware failure or delete crash evidence before analysis.