Who or what has restarted the system…..
Event ID 1074: „The process X has initiated the restart / shutdown of computer on behalf of user Y for the following reason: Z.“ Indicates that an application or a user initiated a restart or shutdown.
Event ID 1076: „The reason supplied by user X for the last unexpected shutdown of this computer is: Y.“ Records when the first user with shutdown privileges logs on to the computer after an unexpected restart or shutdown and supplies a reason for the occurrence.
Quelle: Windows Server restart / shutdown history – Server Fault
Boot off the Windows disk and select the “Repair your computer” option from the lower left-hand corner.
Follow through until you get to the option to open the Command Prompt, which you’ll want to select.
First you’ll want to type in the following command to backup the original sticky keys file:
copy c:\windows\system32\sethc.exe c:\
Then you’ll copy the command prompt executable (cmd.exe) over top of the sticky keys executable:
copy c:\windows\system32\cmd.exe c:\windows\system32\sethc.exe
Now you can reboot the PC.
Resetting the Password
Once you get to the login screen, hit the Shift key 5 times, and you’ll see an administrator mode command prompt.
Now to reset the password—just type the following command, replacing the username and password with the combination you want:
net user geek MyNewPassword
That’s all there is to it. Now you can login.
Of course, you’ll probably want to put the original sethc.exe file back, which you can do by rebooting into the installation CD, opening the command prompt, and copying the c:\sethc.exe file back to c:\windows\system32\sethc.exe.
Quelle: How to Reset Your Forgotten Windows Password the Easy Way