Who Shutdown my OS?

I am running three Windows Server OS’s: Windows NT Server 4.0, Windows Server 2000, and Windows Server 2003.

I have a remote machine that shuts down on occasion without a system event ID of 6008 (Unexpected Shutdown). This makes me believe that a user is shutting down the machine without authorization.

Is there a way to determine when that shutdown command was given and which user shutdown the PC?

Any advice will be much appreciated. Thank You!