On Windows 11 (or 10), the “Event Log” system tracks everything that happens, including when and why the computer restarts or shuts down correctly or incorrectly due to a problem.
Usually, you don’t think about reviewing this information as long as Windows 11 starts up again correctly. However, you may need to know these details to determine if an issue needs attention. Or to understand if Windows Update suddenly rebooted to apply a cumulative update or if the device lost power unexpectedly.
Regardless of the reason, Windows 11 (in addition to Windows 10) includes tools that allow you to check the date, time, and reason the system shut down or restarted unexpectedly using the Event Viewer or querying the event logs with PowerShell and Command Prompt.
This guide will show you the steps to check why the device shut down on Windows 11.
How to determine shutdown reason on Windows 11 from Event Viewer
To check the Event Viewer logs and determine why the device was shut down or restarted on Windows 11, use these steps:
- Open Start.
- Search for Event Viewer and click the top result to open the app.
- Browse the following path: Event Viewer > Windows Logs > System
- Right-click the System category and select the “Filter Current Log” option.
- In the “All Event ID” textbox, include the following ID numbers separated using a comma:
- 41 — The device did not restart correctly using a clean shutdown first. This event could be caused if the computer stopped responding, crashed, or lost power unexpectedly.
- 1074 — This event is triggered when the user initiates a manual shutdown or restart. Or when the system restarts automatically to apply updates, for example. If you were using the shutdown command with a custom message, the information would be recorded in the “Comment” section.
- 6006 — This event is logged when the Event Log system has been stopped by during a good shutdown. This error usually happens after error 1074.
- 6005 — This event was logged when the Event Log system started, which can indicate when the computer was started.
- 6008 — Indicates that the previous system shutdown was unexpected. This error will usually happen after error 41.
- Quick note: The input should look like this: 41,1074,6006,6605,6008. Windows logs many types of logs, these are just a few events you can use to diagnose the problem.
- Click the OK button.
- Double-click a log to confirm the information.
- Quick tip: You can use the down and up keyboard arrows to browse between events. As you move between the logs, the details will appear at the bottom of the screen in the “General” tab.
Once you complete the steps, the information will allow you to determine the time and the possible reason (such as Blue Screen of Death, crash, unexpected power loss, etc.) which may have caused the reboot or shutdown.
Unless you can link these logs to another system component error log, it would be difficult to identify what exactly forced the unexpected shutdown. However, these events will help to understand what happened and where to continue looking.
How to determine shutdown reason on Windows 11 from PowerShell
To find out the reason Windows 11 (or 10) shutdown with PowerShell, use these steps:
- Open Start.
- Search for PowerShell and click the top result to open the app.
- Type the following command to view the event logs and press Enter: Get-WinEvent -FilterHashtable @{ LogName=”System”; Id = 41, 1074, 6006, 6605, 6008; } | Format-List Id, LevelDisplayName, TimeCreated, Message
- Check the log information to determine the time and reason for the shutdown.
After you complete the steps, the events will indicate the date, time, and why Windows 11 was shut down or rebooted.
How to determine shutdown reason on Windows 11 from Command Prompt
To check why the computer shutdown with Command Prompt, use these steps:
- Open Start.
- Search for Command Prompt and click the top result to open the app.
- Type the following command to view the event logs and press Enter: wevtutil qe System /q:”*[System[(EventID=41) or (EventID=1074) or (EventID=6006) or (EventID=6005) or (EventID=6008)]]” /c:100 /f:text /rd:true
- Quick note: The above command will check the 100 more recent logs for the shutdown information. You can modify the “/c:100” option with a different number to check more or fewer events.
- Check each log description to determine the time and reason for the shutdown.
Once you complete the steps, you will understand why the computer was shut down or restarted unexpectedly.
If you use the PowerShell or Command Prompt option, you can also export the output to a text file with these instructions.
More resources
For more helpful articles, coverage, and answers to common questions about Windows 10, visit the following resources:
Cutting-edge operating system
A refreshed design in Windows 11 enables you to do what you want effortlessly and safely, with biometric logins for encrypted authentication and advanced antivirus defenses.
