If you are looking for a way to capture both unexpected and normal reboot of a windows server, you may use the attached SAM template to monitor the corresponding event IDs:
After that, you may now create an alert that would trigger every time the event ID will appear after the last poll on the device.
The attached sample alert will also show you what is the reason behind the Server reboot and who initiated it.
You can modify or improve this according to your liking 
Top Comments