As a database administrator, often times, you need to find-out who rebooted a Windows Server running a SQL Server instance.
Using the “Windows Event Manager” is a drag (IMHO). Use this Powershell command to do it quickly
Get-Eventlog -logname system -message '*restart*' -Newest 10 | Format-Table -wrap
It gets the eventlog of type “system” with the word “restart” anywhere in the message and gets the most recent 10 events.
The format-table with “wrap” is to get a better display of the long messages since the output gets chopped otherwise.