ZEKASTRA

SystemSystem and services

1074 · A process initiated a restart or shutdown

Logged by the User32 source when an application or user initiates a shutdown or restart. The message names the process, the user on whose behalf it acted, the reason, the reason code and the shutdown type.

01Fields in the event

The cited Microsoft page does not list field names for this event.

02How to use it

Identifies who or what requested a reboot (for example an update agent, shutdown.exe or a remote administrator). Place it before the matching 6006 and 6005.

03Caveats

The cited page documents the message text, not structured field names. The reason text is chosen by the initiator and may be generic.

05Sources

  1. Microsoft Learn — Troubleshoot unexpected reboots using system event logs checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.