Windows 2012 shutdown issue.
Event logs for shutdown or reboot of windows 2012 servers.
Event ID 41 The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Event ID 1074 Logged when an app (ex: Windows Update) causes the system to restart, or when a user initiates a restart or shutdown.
Event ID 6006 Logged as a clean shutdown. It gives the message “The Event log service was stopped”.
Event ID 6008 Logged as a dirty shutdown. It gives the message “The previous system shutdown at time on date was unexpected”.
Follow the steps :-
Go to Event Viewer >Windows Logs > System
on the Side bar Action section Click on Filter Current Log
Filter Events 1074, 6006, 6008, 41
Check the latest event .
You will get the shutdown or reboot reason.