Unexpected reboot and shutdown

All NT Server 4.o with sp 6a. One server with SQL 6.5, with SQL sp5.

I have few servers were unexpected reboot in the past months. I could not find out what caused it from event view. I checked it was not related to power.

If I suppected someone reboot my server remotely within our network, how can I check it out and track him down and find out which computer.

If I can not find form audit about shutdown. Does this means that the server reboot itself may cause by user using applications or something nature? I really want to find what happen. Plase provide me any solutions that works to you.

Thank Very Much