Who shutdown the VM

In the Event viewer we need to find the log about who turned off the VM error log id is 1074