Windows Event ID 1074 – User32: System Restart or Shutdown Initiated

Navigate to Event Viewer to examine the specific details of Event ID 1074 occurrences.

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → System
3. In the Actions pane, click Filter Current Log
4. Enter 1074 in the Event IDs field and click OK
5. Double-click any Event ID 1074 entry to view details
6. Examine the General tab for user, process, and reason information
7. Check the Details tab for raw XML data including reason codes

The event description will show format: "The process [process] has initiated the [restart/shutdown] of computer [computer] on behalf of user [domain\user] for the following reason: [reason]"

PowerShell provides powerful filtering capabilities to analyze shutdown patterns and extract specific information from Event ID 1074.

1. Open PowerShell as Administrator
2. Query recent shutdown events:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Filter by specific user or time range:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074; StartTime=(Get-Date).AddDays(-7)} | Where-Object {$_.Message -like "*username*"}

4. Extract structured data from events:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 10 | ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        User = $xml.Event.EventData.Data[6].'#text'
        Process = $xml.Event.EventData.Data[0].'#text'
        Reason = $xml.Event.EventData.Data[2].'#text'
        ReasonCode = $xml.Event.EventData.Data[3].'#text'
    }
}

Understanding shutdown reason codes helps identify the root cause of system restarts and categorize them appropriately.

1. Extract reason codes from recent events:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 50 | ForEach-Object {
    $xml = [xml]$_.ToXml()
    $reasonCode = $xml.Event.EventData.Data[3].'#text'
    $reasonText = $xml.Event.EventData.Data[2].'#text'
    "$($_.TimeCreated): Code $reasonCode - $reasonText"
} | Group-Object | Sort-Object Count -Descending

2. Common reason codes to investigate:

• 0x80020002: Unexpected shutdown (system crash or power loss)
• 0x80020010: Planned shutdown for hardware maintenance
• 0x80020003: Planned shutdown for software installation
• 0x500ff: Windows Update automatic restart
• 0x80000000: User-initiated shutdown with no specific reason

3. Check for unplanned shutdowns specifically:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} | Where-Object {
    $xml = [xml]$_.ToXml()
    $reasonCode = $xml.Event.EventData.Data[3].'#text'
    $reasonCode -match "0x8002000[2-9]|0x8004000[0-9]"
} | Format-Table TimeCreated, Message -Wrap

Enable enhanced shutdown tracking through Group Policy or registry settings to capture more detailed information about shutdown events.

1. Open Group Policy Editor (gpedit.msc) or Registry Editor for manual configuration
2. Navigate to Group Policy path:

Computer Configuration → Administrative Templates → System → Shutdown Options

3. Enable "Display Shutdown Event Tracker" policy
4. For registry configuration, modify:

Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" -Name "ShutdownReasonUI" -Value 1 -Type DWord
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" -Name "ShutdownReasonOn" -Value 1 -Type DWord

5. Configure shutdown reason tracking for servers:

New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability" -Name "ShutdownReasonUI" -Value 1 -PropertyType DWord -Force
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability" -Name "ShutdownReasonOn" -Value 1 -PropertyType DWord -Force

6. Restart the system for changes to take effect
7. Verify configuration by checking that shutdown dialogs now prompt for reason selection

Set up automated monitoring to track shutdown patterns and alert on suspicious or unexpected restart activity.

1. Create a PowerShell script for continuous monitoring:

# Save as Monitor-Shutdowns.ps1
$lastCheck = (Get-Date).AddHours(-1)
$events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074; StartTime=$lastCheck}

foreach ($event in $events) {
    $xml = [xml]$event.ToXml()
    $user = $xml.Event.EventData.Data[6].'#text'
    $process = $xml.Event.EventData.Data[0].'#text'
    $reasonCode = $xml.Event.EventData.Data[3].'#text'
    
    # Alert on unexpected shutdowns
    if ($reasonCode -match "0x80020002|0x80040000") {
        Write-EventLog -LogName Application -Source "ShutdownMonitor" -EventId 9001 -EntryType Warning -Message "Unexpected shutdown detected: User=$user, Process=$process, Reason=$reasonCode"
        # Send email or SIEM alert here
    }
}

2. Create a scheduled task to run the monitoring script:

$action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-Shutdowns.ps1"
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount
Register-ScheduledTask -TaskName "ShutdownMonitoring" -Action $action -Trigger $trigger -Principal $principal

3. Configure Windows Event Forwarding for centralized collection:

# On collector server
wecutil qc /q
# On source computers
winrm qc /q
wecutil cs subscription.xml

4. Set up custom event log source for monitoring alerts:

New-EventLog -LogName Application -Source "ShutdownMonitor"