Windows Server restart / shutdown history
The clearest most succinct answer I could find is: How To See PC Startup And Shutdown History In Windows which lists these event ids to monitor (quoted but edited and reformatted from article): Event ID 6005 (alternate): “The event log service was started.” This is synonymous to system startup. Event ID 6006 (alternate): “The event … Read more