Who restarted my Windows server?

Solution 1:

In the System event log, filter by event id 1074, this will show by which process and on behalf of which user a reboot was initiated.

This was tested on Windows Server 2008.

Solution 2:

There should be a log at:

%windir%\system32\LogFiles\Shutdown

(which should be C:\WINDOWS\system32\LogFiles\Shutdown on a "standard" Windows Server 2000/2003 install)