To find out what restarted windows server:
Login to Windows Server
Launch the Event Viewer (type eventvwr in run)
In the event viewer console expand Windows Logs
Click System and in the right pane click Filter Current Log
In the Filter Current log box, type 1074 as the event ID. This will filter the events and you will see events only with ID 1074. 
—
To find install events on windows server:
Installation events can have an Event ID of 11707 or 1033. The InstallOperation field of these events indicate Installation completed. Uninstallation events can have an Event ID of 11724 or 1034.
