Windows: Shutdown/Reboot Event IDs – Get Logs

While troubleshooting an issue that causes an unexpected reboot or shutdown of a Windows machine, it is important to know which event IDs are related to system reboot/shutdown and how to find the appropriate logs.

In this note i am publishing all the event IDs related to reboots/shutdowns.

I am also showing how to display the shutdown events with date and time, using a Windows Event Viewer or from the command-line using a PowerShell.

Cool Tip: How to boot Windows in Safe Mode! Read more →

Shutdown Event IDs

The list of the Windows event IDs, related to the system shutdown/reboot:

Event ID	Description
41	The system has rebooted without cleanly shutting down first.
1074	The system has been shutdown properly by a user or process.
1076	Follows after Event ID 6008 and means that the first user with shutdown privileges logged on to the server after an unexpected restart or shutdown and specified the cause.
6005	The Event Log service was started. Indicates the system startup.
6006	The Event Log service was stopped. Indicates the proper system shutdown.
6008	The previous system shutdown was unexpected.
6009	The operating system version detected at the system startup.
6013	The system uptime in seconds.

Display Shutdown Logs in Event Viewer

The shutdown events with date and time can be shown using the Windows Event Viewer.

Start the Event Viewer and search for events related to the system shutdowns:

1. Press the Win keybutton, search for the eventvwr and start the Event Viewer
2. Expand Windows Logs on the left panel and go to System
3. Right-click on System and select Filter Current Log.
4. Type the following IDs in the field and click OK :

Cool Tip: Get history of previously executed commands in PowerShell! Read more →

Find Shutdown Logs using PowerShell

For example, to filter the 10000 most recent entries in the System Event Log and display only events related to the Windows shutdowns, run:

Cool Tip: Start/Stop a service in Windows from the CMD & PowerShell! Read more →

How to check the Shutdown and Startup Log in Windows 10

Finding out the last time the PC was correctly turned off or booted up is the way to start for troubleshooting many Windows issues. Another scenario is a public system. Thanks to the Event Viewer, administrators can view and monitor unauthorized use of the computer.

Whatever reason it is, you can find out when last your PC was put on and shut down directly from Windows. You don’t need a third-party app for this; the Windows Event Viewer can handle it perfectly.

What is the Windows Event Viewer?

The Windows Event Viewer is a Microsoft Management Console (MCC) – a core service of Windows that cannot be stopped or disabled. It keeps track of every activity that takes place on your PC.

During every event, the Event Viewer logs entries. It also logs the start and stop times of the event log service (Windows), giving correct date, time, and user details of every shutdown process.

How to use the Event Viewer?

Aside from keeping a log of when your Windows start and stop, you can use the Event Viewer for the following:

1. Create custom views by saving useful events filters.
2. You can see events from different event logs.
3. You can also create and manage different event subscriptions.
4. Create and schedule a task to run when triggered by another event.

Types of events in Windows 10 related to shutting down and restarting

They are more than four events related to shutting down and restarting the Windows 10 operating system; we will list the important five. They are:

• Event ID 41: This event indicates that Windows rebooted without a complete shutdown.
• Event ID 1074: This event is written down when an application is responsible for the system shut down or restart. It also indicates when a user restarted or shut down the system by using the Start menu or by pressing CTRL+ALT+DEL.
• Event ID 6006: This event indicates that Windows was adequately turned off.
• Event ID 6008: This Event indicates an improper or dirty shutdown. It shows up when the most recent shutdown was unexpected.

How to find the shutdown log in Windows 10

They are different ways to find out any of the events listed above. The traditional way is through the Event Viewer app itself. Most events can be accessed with the Command Prompt, as you will see below.

1] View shutdown and restart events from Event Viewer

Open the Run dialogue box, and input eventvwr.msc then hit Ok. In Event Viewer, select Windows Logs > System from the left pane. From the right, click on the Filter Current Log link.

Type in 41,1074,6006,6008 into the box below Includes/Exclude Event IDs. Hit Ok. Windows then displays all shutdown-related events.

The Event Viewer shows detailed information on every operation carried out on the system. Learn how to view full event viewer logs in this article.

2] See the last shutdown time using Command Prompt

Open the Command Prompt, copy and paste the following code in the window, and hit Enter:

To view the timestamp of the last shutdown without other details, copy and paste the code below then hit Enter:

As much as this method gets the job done, we often suggest you use method one, which is the Event Viewer. Not only is it more straightforward, but it also doesn’t involve copying and pasting commands.

Improper shutdown

what are the effects of improper shutdown windows 8?

how to know if improper shutdown has done any damage?

Replies (7) 

Usually this is caused due to hardware or software related issues.

To check for the cause and error message for the improper shutdown, I would suggest you to check for the event logs in Event Viewer. Event Viewer tracks information in several different logs. Windows Logs include:

Application (program) events. Events are classified as error , warning , or information , depending on the severity of the event. An error is a significant problem, such as loss of data. A warning is an event that isn’t necessarily significant, but might indicate a possible future problem. An information event describes the successful operation of a program, driver, or service.

Security-related events. These events are called audits and are described as successful or failed depending on the event, such as whether a user trying to log on to Windows was successful.

Setup events. Computers that are configured as domain controllers will have additional logs displayed here.

System events. System events are logged by Windows and Windows system services, and are classified as error, warning, or information.

Forwarded events. These events are forwarded to this log by other computers.

Follow the steps to check the Event Viewer:

a. Press Windows + X keys.

b. Click Event Viewer.

Please reply if the information provided is not helpful so that we can help you better.

7 people found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

my question was would it damage my os

and other software? . if yes

how to find those problems and fix them ?

5 people found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Thank you for the reply.

Does the computer shutsdown by itself?

If the answer to the above question is yes, then unexpected shutdown usually happens when the hardware components connected to the computer are overclocked and overheated. This can also be due to some blue screen errors on the computer which are usually caused by hardware devices and drivers.

In Windows Operating System, if some fatal/critical error occurs on the computer, it comes with a blue screen error which provides a bug-check error code which is used to identify the root cause of the issue. A bug-check (BSOD) is a mechanism to protect your PC from damage when such critical errors occurs on it.

This means that there are issues with computer if it shutsdown automatically.

Please write us back with the required information and we will be glad to help you further.

1 person found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

no the PC didn’t shut down itself

i forced it by pressing and holding power button.

what would improper shutdown possibly do to my OS.

i just don’t want any problems in future.

2 people found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Thank you for the quick reply.

The effects of a forceful shutdown are mentioned below. It not only effects the software but, also the other features in the computer. So, its always prefered to shutdown the computer through the Shutdown option in Windows.

a) Improperly shutting down your computer can cause some harmful effects for your software. Though the operating systems are better equipped to handle an improper shut down, there are still negative effects associated with it. Computers should be shut down improperly only when there are no other options available, such as in the case of a your computer freezing.

b) If a computer is improperly shut down, for instance by a power failure, then registry files cease operation while they are still performing a function. This is the main cause of potential problems. Any applications or processes that were running at the time of shut down also will be interrupted and any files that were not saved will be lost. Any settings that may have been changed just prior to shut down also will most likely not take effect.

c) The hard drive may be effected negatively by an improper shut down. This is because the read and write heads will have been in the middle of a process, meaning that they will be rotating at high speeds when your computer shut down.

d) The computers system restore process may be interrupted. System restore allows you to restore your computer to a previous state if it becomes corrupted.

e) Hardware will only be effected if it is in use.

Hope this helps. Otherwise, feel free to write us back and we will be glad to help you further.

How to Find the Shutdown Log in Windows 10

If you are curious to know why your computer shut down and what happened exactly during the shut down, you will be happy to know that Windows is able to track the shut down process and write a number of events in the system log. In this article, we will see how to find them.

In Windows 10, there are three events connected with shut down and restart.

Event ID 1074 — Indicates that the shut down process was initiated by an app. For example, it can be Windows Update.

Event ID 6006 — The clean shut down event. This means Windows 10 was turned off correctly.

Event ID 6008 — Indicates a dirty/improper shutdown. Appears in the log when the previous shutdown was unexpected, e.g. due to power loss or BSoD (Bug check).

Here is how to find these events.

To find the Shutdown log in Windows 10, do the following.

1. Press the Win + R keys together on the keyboard to open the Run dialog, type eventvwr.msc, and press the Enter key.
2. In Event Viewer, select Windows Logs -> System on the left.
3. On the right, click on the link Filter Current Log.
4. In the next dialog, type the line 1074, 6006, 6008 into the text box under Includes/Excludes Event IDs.
5. Click OK to filter the event log.

Now, the Event Viewer will display only events related to shut down.

Note: Starting with Windows 10 Fall Creators Update, the operating system is able to automatically reopen apps which were running before shutdown or restart. This behavior is totally unexpected for most Windows users who upgraded to the recent release of the OS. To avoid this issue, you can add a special «Shut Down» context menu to the Desktop that restores the classic behavior.

See the following article:

Winaero greatly relies on your support. You can help the site keep bringing you interesting and useful content and software by using these options:

Share this post

About Sergey Tkachenko

Sergey Tkachenko is a software developer from Russia who started Winaero back in 2011. On this blog, Sergey is writing about everything connected to Microsoft, Windows and popular software. Follow him on Telegram, Twitter, and YouTube.

2 thoughts on “ How to Find the Shutdown Log in Windows 10 ”

Thank you, it worked.

Thanks for simple explanation. It worked.

Leave a Reply Cancel reply

Connect with us

We discontinued Facebook to deliver our post updates.