guidox / PC
Read event **1074** for a planned restart, **6008** for an unexpected one and **41** for a power loss. The message in 1074 names the process and the account.
**1074** is a clean shutdown with the requesting process and user, **6006** and **6005** mark the clean intervals, and **41** reports an unexpected power loss.
Get-WinEvent -FilterHashtable @{LogName='System';Id=1074,6005,6006,6008,41} -MaxEvents 20 | Select-Object TimeCreated,Id,ProviderName,Message | Format-ListThe 1074 message includes the process, the reason and the user. A restart requested by **svchost.exe** with reason **Operating System: Recovery** is Windows Update.
Get-WinEvent -FilterHashtable @{LogName='System';Id=1074} -MaxEvents 5 | ForEach-Object { $x=[xml]$_.ToXml(); [pscustomobject]@{ Time=$_.TimeCreated; Process=($x.Event.EventData.Data | Where-Object Name -eq 'param1').'#text'; Reason=($x.Event.EventData.Data | Where-Object Name -eq 'param2').'#text'; User=($x.Event.EventData.Data | Where-Object Name -eq 'param7').'#text' } }A bugcheck appears as event **1001** with a code, and as a memory dump in the minidump folder. A clean 1074 right before the boot rules a crash out.
Get-WinEvent -FilterHashtable @{LogName='System';Id=1001} -MaxEvents 5 | Select-Object TimeCreated,Message
Get-ChildItem "$env:systemroot\Minidump" -ErrorAction SilentlyContinue | Select-Object Name,Length,LastWriteTime
Get-CimInstance Win32_OperatingSystem | Select-Object LastBootUpTimeEvent **41** with no bugcheck code means the machine lost power or was hard reset. A dying power supply and an unstable overclock look identical here.
Get-WinEvent -FilterHashtable @{LogName='System';Id=41} -MaxEvents 5 | Select-Object TimeCreated,Message
Get-CimInstance Win32_BIOS | Select-Object SMBIOSBIOSVersion,ReleaseDate
Get-WinEvent -FilterHashtable @{LogName='System';Id=6008} -MaxEvents 5 | Select-Object TimeCreated,MessageA task with a restart action, or an update with a deadline, explains a reboot at a fixed time. Both are visible before the next occurrence.
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'shutdown|Restart' } | Select-Object TaskName,TaskPath,State
Get-WinEvent -LogName 'Microsoft-Windows-WindowsUpdateClient/Operational' -MaxEvents 20 -ErrorAction SilentlyContinue | Where-Object Id -in 19,43,44 | Select-Object TimeCreated,Id,Message -First 5One reboot can be a coincidence. A table of boots and their cause over a week shows whether it is a schedule, a crash or a power fault.
Get-WinEvent -FilterHashtable @{LogName='System';Id=1074,41,6008} -MaxEvents 50 | Select-Object TimeCreated,Id,@{n='Cause';e={ if($_.Id -eq 1074){'planned'} elseif($_.Id -eq 41){'power'} else {'unexpected'} }} | Sort-Object TimeCreated -Descending | Format-Table -AutoSizeAn unclean shutdown can lose the last events. Check the previous boot's log with Get-WinEvent -LogName System -Oldest, or read the dump file.
An installer or a management agent requested it. Check the Application log for the matching product at the same timestamp.
That is a crash, not a power loss. Analyse the dump and check the driver named in the stack.
The machine lost power hard, or the disk was not writable at the time. Check the PSU and the cabling.
Yes, 1074 includes the account for an interactive shutdown. A shutdown from a remote tool names the service account instead.
It logs 1074 for the shutdown, and 6005 for the next boot. The hybrid state makes it look like a resume in some logs.
Until the System log wraps. On a busy machine that can be days, so export the events you need.
Nothing is changed by reading the log. If you disabled a restart task, re-enable it with Enable-ScheduledTask after the investigation.
Free · no account needed · tracks your progress