Event ID 1074 — Stop or restart initiated by a process

A process or user requested a scheduled shutdown or restart.

Source of event

USER32 — System category.

Possible causes

• Windows Update.
• User action
• Tool of administration

Verifications to be carried out

1. Identify the initiator process
2. ReadKen Code and Comments
3. Check User Account

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.