Windows EventInformation
Windows Event ID 1074 – User32: System Restart or Shutdown Initiated
Event ID 1074 records when a system restart or shutdown is initiated by a user or application. This informational event tracks who initiated the action and the reason code.