Skip to main content

2025-10-15 Windows: Shutdown/Reboot Event IDs – Get Logs

source: shellhacks.com

While troubleshooting an issue that causes an unexpected reboot or shutdown of a Windows machine, it is important to know which event IDs are related to system reboot/shutdown and how to find the appropriate logs.

In this note i am publishing all the event IDs related to reboots/shutdowns.

I am also showing how to display the shutdown events with date and time, using a Windows Event Viewer or from the command-line using a PowerShell.

Shutdown Event IDs

The list of the Windows event IDs, related to the system shutdown/reboot:

Event ID

Description

41

The system has rebooted without cleanly shutting down first.

1074

The system has been shutdown properly by a user or process.

1076

Follows after Event ID 6008 and means that the first user with shutdown privileges logged on to the server after an unexpected restart or shutdown and specified the cause.

6005

The Event Log service was started. Indicates the system startup.

6006

The Event Log service was stopped. Indicates the proper system shutdown.

6008

The previous system shutdown was unexpected.

6009

The operating system version detected at the system startup.

6013

The system uptime in seconds.

Display Shutdown Logs in Event Viewer

The shutdown events with date and time can be shown using the Windows Event Viewer.

Start the Event Viewer and search for events related to the system shutdowns:

  • Press the ⊞ Win keybutton, search for the eventvwr and start the Event Viewer
  • Expand Windows Logs on the left panel and go to System
  • Right-click on System and select Filter Current Log...
  • Type the following IDs in the <All Event IDs> field and click OK:
  • 41,1074,1076,6005,6006,6008,6009,6013

Find Shutdown Logs using PowerShell

The shutdown/reboot logs in Windows can also be retrieved from the command-line using the PowerShell’s Get-EventLog command.

For example, to filter the 10000 most recent entries in the System Event Log and display only events related to the Windows shutdowns, run:

PS C:\> Get-EventLog System -Newest 10000 | `
        Where EventId -in 41,1074,1076,6005,6006,6008,6009,6013 | `
        Format-Table TimeGenerated,EventId,UserName,Message -AutoSize -wrap

Cara mengetahui kapan waktu komputer laptop windows 11 tiba-tiba mati daya shutdown paksa karena mati lampu contohnya

Back to top