149536
Sep 15, 2021
16819
1
1
Find who restarted DB server
Hi, I am working as sys admin for a small company. Someone restarted the SQL DB server and I want to find the user name who did that. I have referred the following post already https://www.prajwaldesai.com/restarted-windows-server/ but I am unable to find event ID 1074. When i search for it, it shows nothing. How to find the user ?
Share on Facebook
Share on Twitter
Share on Reddit
Share on LinkedinPlease also mark the comments that contributed to the solution of the article
Content-ID: 1265447060
Url: https://rootdb.com/en/find-who-restarted-db-server-1265447060.html
Printed on: February 22, 2025 at 23:02 o'clock
1 Comment
Hi
you could check for the systems last boot and then check if there is any error logged around that time.
The system could also be crashed (bluescreen) and auto-rebooted. You wouldnt see a 1074 in that case as noone initiated the shutdown. In that case, you should see an event ID 6008 "unexpected shutdown".
If that is the case, you can use a bluescreen-analyzer like BluescreenView to see what caused the bluescreen
you could check for the systems last boot and then check if there is any error logged around that time.
The system could also be crashed (bluescreen) and auto-rebooted. You wouldnt see a 1074 in that case as noone initiated the shutdown. In that case, you should see an event ID 6008 "unexpected shutdown".
If that is the case, you can use a bluescreen-analyzer like BluescreenView to see what caused the bluescreen
1
