Published by


Brink's Avatar
Administrator

Posts: 25,280

Show Printable Version 


How to Read Shutdown Event Logs in Windows

information   Information
You can use Event Viewer to view the date, time, and user details of all shutdown events caused by a shut down (power off) or restart.

The event ID's below will show you these details.

Event ID Description
1074 Logged when an app (ex: Windows Update) causes the system to restart, or when a user initiates a restart or shutdown.
6006 Logged as a clean shutdown. It gives the message "The Event log service was stopped".
6008 Logged as a dirty shutdown. It gives the message "The previous system shutdown at time on date was unexpected".

This tutorial will show you how to view the date, time, and user details of all shutdown event logs in Windows 7, Windows 8, and Windows 10.


Here's How:

1. Press the Win+R keys to open Run, type eventvwr.msc, and click/tap on OK to open Event Viewer.

2. In the left pane of Event Viewer, open Windows Logs and System, right click or press and hold on System, and click/tap on Filter Current Log. (see screenshot below)

Click image for larger version. 

Name:	shutdown_event_logs-1.png 
Views:	331 
Size:	89.1 KB 
ID:	123130

3. Enter the event ID's below into the <All Event IDs> field, and click/tap on OK. (see screenshot below)

1074, 6006, 6008

Name:  shutdown_event_logs-2.png
Views: 9438
Size:  26.9 KB

4. You can now view the details of these shutdown event logs filtered by these event IDs. (see screenshots below)

Click image for larger version. 

Name:	event_ID_1074_power-off.png 
Views:	422 
Size:	72.9 KB 
ID:	123132
Click image for larger version. 

Name:	event_ID_1074_restart.png 
Views:	397 
Size:	73.7 KB 
ID:	123133
Click image for larger version. 

Name:	event_ID_6006.png 
Views:	95 
Size:	67.3 KB 
ID:	123134
Click image for larger version. 

Name:	event_ID_6008.png 
Views:	269 
Size:	68.1 KB 
ID:	123135

5. When finished viewing log details, you can close Event Viewer if you like.


That's it,
Shawn