Working out why a server rebooted..?

[evilsatan]

Had an issue yesterday where a server rebooted in the middle of the day. There were no memory dumps so I went through the system event log and filtered by event ID 1074 which was for system shut down and found the culprit:

The process G:\ec2cdc22bd6309305d0603ca21\setup.exe has initiated the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: Other (Planned) Reason Code: 0x80000000
Shutdown Type: restart
Comment:

The temp folder no longer exists and is not in the recycle bin either so I cannot hunt in there to see what program updated itself.

I have already set windows update to download and scheduled the installs for Sunday so there are no reboots during a working day.

Does anyone have any idea how I can work out what ran the update?

Cheers

EDIT:
I hadn't thought to cross-reference the time in the application log (very tired today), it looks like Sage was what updated and the .NET framework was what required the reboot.