Read Shutdown and Restart Event Logs in Windows
eventvwr.msc
Windows Logs and System, right click or press and hold on System, and click/tap on Filter Current Log.
voir aussi id 41 , 1076
uptime 6013
| Event ID | Description |
| 1074 | Logged when an app (ex: Windows Update) causes the system to restart, or when a user initiates a restart or shutdown. |
| 6006 | Logged as a clean shutdown. It gives the message « The Event log service was stopped ». |
| 6008 | Logged as a dirty shutdown. It gives the message « The previous system shutdown at time on date was unexpected ». |
Event to monitoring
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn535498(v=ws.11)
Security log Events
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx