Who or what has restarted the system…..

Event ID 1074: „The process X has initiated the restart / shutdown of computer on behalf of user Y for the following reason: Z.“ Indicates that an application or a user initiated a restart or shutdown.

Event ID 1076: „The reason supplied by user X for the last unexpected shutdown of this computer is: Y.“ Records when the first user with shutdown privileges logs on to the computer after an unexpected restart or shutdown and supplies a reason for the occurrence.

Quelle: Windows Server restart / shutdown history – Server Fault