The event IDs that can be searched on in windows event viewer for the confirmation of shutdown or restart.
| Event ID | Name | Description |
|---|---|---|
| 14 | The system has rebooted without cleanly shutting down first | This event indicates that some unexpected activity prevented Windows from shutting down correctly. Such a shutdown might be caused by an interruption in the power supply or by a Stop error. If feasible, Windows records any error codes as it shuts down. |
| 1074 | System has been shutdown by a process/user. | This event is written when an application causes the system to restart, or when the user initiates a restart or shutdown by clicking Start or pressing CTRL+ALT+DELETE, and then clicking Shut Down. |
| 6006 | The event log service was stopped. | The event is logged at boot time noting that the Event Log service was stopped. |
| 6008 | Unexpected system shutdown | The previous system shutdown at Time on Date was unexpected. |