\\\ Windows System Shutdown and Restart History

Windows System Shutdown and Restart History

We can check shutdown and restart history — especially to find out why a server or PC rebooted.

 

1. Open Event Viewer

  • Run: eventvwr.msc

  • Navigate to: Windows Logs → System

2. Key Event IDs to Look For

Event IDSourceDescription
41Kernel-PowerSystem rebooted without clean shutdown (often power loss or hardware issue).
1074User32Event triggered by user or process requesting a shutdown or restart.
6006EventLog“The Event log service was stopped.” (Indicates a clean shutdown)
6008EventLog“The previous system shutdown was unexpected.”
6005EventLog“The Event log service was started.” (Often system startup)

3. How to Analyze

  • Unexpected shutdown: Look for Event ID 6008 and Kernel-Power 41 around the same timestamp.

  • Determine cause: If Event ID 1074 is present, it might give a reason or the process/user that initiated shutdown.

  • Time correlation: Match shutdown time with logs from antivirus, Windows Update, or third-party software.

Example Audit Process

  1. Filter System log for Event IDs: 41, 1074, 6006, 6008, 6005.

  2. Start from most recent unexpected shutdown (6008) and check surrounding logs.

  3. Cross-check with:

    • Security logs (for logins, process starts)

    • Application logs (app crashes, update failures)