Read Shutdown Logs in Event Viewer in Windows

zbook · 01 Mar 2020

An additional event seen with crashes is 41: (lost power unexpectedly)

Code:

Event:
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 
  Event ID: 41
  Task: N/A
  Level: Critical
  Opcode: Info
  Keyword: 
  User: 
  User Name: 
  Computer: 
  Description: 
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Brink · 01 Mar 2020

zbook said:

An additional event seen with crashes is 41: (lost power unexpectedly)

Thank you. Now added to tutorial.

stevehero · 31 Jan 2021

You can also create a custom filter to filter the various different types such as a poweroff event explicitly like so. Otherwise there's no other way to do so with a basic filter.

I needed this write this query when I was trying to create a Task Scheduler to run a program to turn off my NAS when the PC was shutting down.

Code:

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">
    *[System[Provider[@Name='User32'] and (Level=4 or Level=0) and (EventID=1074)]]
   and 
     *[EventData[Data[@Name='param5'] and (Data='power off')]]
    </Select>
  </Query>
</QueryList>

Exsosus · 4 Days Ago

Hi, I wanted to add a Thank you! This is working correctly on Win 11 OS version: 23H2.
When adding the numbers 1074, 6006, 6008, and 41 to the filter area, just space them with commas and you are set like this:
1074, 6006, 6008, 41

Next, sort by date, as newest date first (recommended).

Michael

Brink · 4 Days Ago

Exsosus said:

Hi, I wanted to add a Thank you! This is working correctly on Win 11 OS version: 23H2.
When adding the numbers 1074, 6006, 6008, and 41 to the filter area, just space them with commas and you are set like this:
1074, 6006, 6008, 41

Next, sort by date, as newest date first (recommended).

Michael

Event ID	Description
41	The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
1074	Logged when an app (ex: Windows Update) causes the system to restart, or when a user initiates a restart or shutdown.
6006	Logged as a clean shutdown. It gives the message "The Event log service was stopped".
6008	Logged as a dirty shutdown. It gives the message "The previous system shutdown at time on date was unexpected".