Подробное описание с способы поиска логов описаны в статье https://www.shellhacks.com/windows-shutdown-reboot-event-ids-get-logs/
Shutdown Event IDs
The list of the Windows event IDs, related to the system shutdown/reboot:
| Event ID | Description |
|---|---|
| 41 | The system has rebooted without cleanly shutting down first. |
| 1074 | The system has been shutdown properly by a user or process. |
| 1076 | Follows after Event ID 6008 and means that the first user with shutdown privileges logged on to the server after an unexpected restart or shutdown and specified the cause. |
| 6005 | The Event Log service was started. Indicates the system startup. |
| 6006 | The Event Log service was stopped. Indicates the proper system shutdown. |
| 6008 | The previous system shutdown was unexpected. |
| 6009 | The operating system version detected at the system startup. |
| 6013 | The system uptime in seconds. |
PS C:\> Get-EventLog System -Newest 10000 | ` Where EventId -in 41,1074,1076,6005,6006,6008,6009,6013 | ` Format-Table TimeGenerated,EventId,UserName,Message -AutoSize -wrap
MK Microsoft Windows Administrator 