Find Who Restarted Windows Server

–Run the following command to filter the System Logs with Source as User32.

Get-EventLog -LogName System | Where Source -eq User32

–You may also filter the system logs with Event ID 1074 with the following command.

Get-EventLog -LogName System | Where EventID -eq 1074