Question:
Being responsible for a PC cluster, it would be nice for me to automatically keep track of the reasons why a certain PC was restarted. Instead of manually logging them, is there a way where the PC itself can keep such a log, so that I can consult it afterwards?
Answer:
Yes there is. Go down the registry tree
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Reliability
In there, you should find a key value called “ShutdownReasonUI” (if not, create one, of data type REG_DWORD). Edit it and set its value to 1.
When you now shut down or restart the PC, the shutdown dialog box is expanded and contains a tick box for planned or unplanned restart, as well as a comment menu. It has to be filled in before the shutdown can take place.
This will create an entry in the Event Log which may then be consulted after the reboot. Its event ID is 1074.
To undo this operation, reset the above key value to 0.