1074 is the important one, but try these as well.
6005,6006,6008,6009,6013,1074,1076
http://serverfault.com/questions/702828/windows-server-restart-shutdown-history