The event IDs that can be searched on in windows event viewer for the confirmation of shutdown or restart.
|14||The system has rebooted without cleanly shutting down first||This event indicates that some unexpected activity prevented Windows from shutting down correctly. Such a shutdown might be caused by an interruption in the power supply or by a Stop error. If feasible, Windows records any error codes as it shuts down.|
|1074||System has been shutdown by a process/user.||This event is written when an application causes the system to restart, or when the user initiates a restart or shutdown by clicking Start or pressing CTRL+ALT+DELETE, and then clicking Shut Down.|
|6006||The event log service was stopped.||The event is logged at boot time noting that the Event Log service was stopped.|
|6008||Unexpected system shutdown||The previous system shutdown at Time on
Date was unexpected.