We had similar issues with a PC that kept running windows updates and restarting automatically, check if you have disabled windows updates.
For monitorig power you could look at a 'mains fail" relay onto a plug point and wire this into a camera. Hopefullythe camera or vms can the power interuption log this event before shutting down.
This info should already be in your system event log (more or less). This link might help:
How to tell when your PC rebooted
For checking power, we use a Fluke VR1710.
Another more simpel solution is using a relay which feeds itself trough it's own contact. You start it by manually making the contact, it will then keep itself up. Then if you have a power dip, it will fall off and stay off. Always an easy and simple way to see if you had a power dip.
Edit: relay drawing
It is not clear from the post if the NVR is located inside a protected space or not but I am going on a limb here. As dumb as it may seem, make sure nobody is unplugging the PC NVR from the wall in order to use the outlet. I had such an incident at a customer's site where there was a centralized UPS solution. We went nuts troubleshooting mysterious shutdowns on a PC only to find out the cleaning crew was unplugging the unit from the wall in order to plug their vacuum cleaner. If you have a local UPS (Placed very inconveniently so they don't plug to the UPS) at least it would start beeping and may alert the offender that they just unplugged something critical, or so we hope.
Seneca | IPVMU Certified | 11/24/14 05:50am
There IS a way to tell the difference between a forced power off via Power Button and a hard power loss in the event log.
Open up the Kernal Power event...usually '41' and inspect the value for the powerbuttontimestamp.
A non zero value means a human was involved.
Here is an example.....
Log Name: System
Event ID: 41
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
The Details tab shows the following information:
Are you just wanting to find out at what time the pc powered off? You could write a looping batch file that periodically appends the date and time to a text file. Then if it powers off you will be able to see the approximate time it happened by looking at the text file. A Google search will show you a few different ways you could do this with a batch file.
It's not unusual for a pc to shutdown if it overheats. Could be any part, processor, video card, hdd. If you know how to service pcs, you might want to open the case and see how dirty it is, carefully feel around to see if anything is too hot. There is pc temp monitoring software on cnet.com or other location for free. If you feel someone is shutting it down how about adding a temporary camera to view just the pc?
IPVMU Certified | 11/24/14 09:51am
Post the log file here mate, and we can identify the issue from it.
Seneca | IPVMU Certified | 11/24/14 10:10am
In the 'System' event log, Right near the Kernal-Power and kernal-General is one called EventLog.with an id of 6008.
It will have the time of the shutdown event. (note that the underlined EventLog is NOT the one that matches the detailed information. It is simply the closest one to the bottom when I grabbed the screen shot)