Who Rebooted the Server ID1074 Challenge
Who keeps rebooting the server?
Scenario:
Let say you are the lead admin, and you notice that someone is restarting one of the remote computers or servers and you want to find out who is doing it and when they are rebooting the server or computer.
The event ID for a restart or reboot has an Event ID of 1704. With this information, how can you use PowerShell to solve this problem?
No comments yet. Add the first comment to start the discussion.