Did Windows 10 shut down unexpectedly? Here's how you can find out why.

Did your computer shut down unexpectedly, or you found that it restarted? If so, you can use these instructions to find out why this happened on Windows 10.

On Windows 10, the Event Log system tracks everything that happens, including when and why the computer restarts or shuts down correctly or due to a problem.

Although you would not typically think about reviewing this information as long as Windows 10 starts up again correctly, sometimes, you may need to know these details to determine if there is an issue that needs attention. Or to understand if Windows Update suddenly rebooted the system to apply a new update, or the device lost power unexpectedly.

Regardless of the reason, Windows 10 includes different ways to check the date, time, and reason why the system shut down or restarted unexpectedly using the Event Viewer or querying the event logs with PowerShell and Command Prompt.

In this Windows 10 guide, we will show you the steps to check why the device shut down.

• How to determine shutdown reason on Windows 10 with Event Viewer
• How to determine shutdown reason on Windows 10 with PowerShell
• How to determine shutdown reason on Windows 10 with Command Prompt

How to determine shutdown reason on Windows 10 with Event Viewer

To check the Event Viewer logs and determine why the device was shut down or restarted, use these steps:

1. Open Start.
2. Search for Event Viewer and click the top result to open the console.

3. Browse the following path:

   Event Viewer > Windows Logs > System

4. Right-click the System category and select the Filter Current Log option.

   

5. In the "All Event ID" textbox, include the following ID numbers separated using a comma:

   • 41 — The device did not restart correctly using a clean shutdown first. This event could be caused if the computer stopped responding, crashed, or lost power unexpectedly.
   • 1074 — This event is triggered when the user initiates a manual shutdown or restart. Or when the system restarts automatically to apply updates, for example. If you were using the shutdown command with a custom message, the information would be recorded in the "Comment" section.
   • 6006 — This event is logged when the Event Log system has been stopped by during a good shutdown. This error usually happens after error 1074.
   • 6005 — This event is logged when the Event Log system started, which can indicate when the computer was booted.
   • 6008 — Indicates that the previous system shutdown was unexpected. This error will usually happen after error 41.

   

   Quick note: The input should look like this: 41,1074,6006,6605,6008. Windows 10 logs many types of logs, these are just a few events you can use to diagnose the problem.

6. Click the OK button.

7. Double-click a log to confirm the information.

   

   Quick tip: You can use the down and up keyboard arrows to browse between events. As you move between the logs, the details will appear at the bottom of the screen, in the "General" tab.

Once you complete the steps, you will know when and the possible reason (such as Blue Screen of Death, crashed, unexpected power lost, etc.), which may have caused the reboot or shutdown of the computer.

Unless you can link these logs to another system component error log, it would be difficult to identify what exactly forced the device to unexpected. However, these events will help to under what happens and where to continue looking.

How to determine shutdown reason on Windows 10 with PowerShell

To find out the reason Windows 10 shutdown with PowerShell, use these steps:

1. Open Start.
2. Search for PowerShell and click the top result to open the console.

3. Type the following command to view event logs and press Enter:

   Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 41, 1074, 6006, 6605, 6008; } | Format-List Id, LevelDisplayName, TimeCreated, Message

   

4. Check the log information to determine the time and reason for the shutdown.

After you complete the steps, the events will indicate the date, time, and reason why Windows 10 was shut down or rebooted.

How to determine shutdown reason on Windows 10 with Command Prompt

To check why the computer shutdown with Command Prompt, use these steps:

1. Open Start.
2. Search for Command Prompt and click the top result to open the console.

3. Type the following command to view event logs and press Enter:

   wevtutil qe System /q:"*[System[(EventID=41) or (EventID=1074) or (EventID=6006) or (EventID=6005) or (EventID=6008)]]" /c:100 /f:text /rd:true

   

   Quick note: The above command will check the 100 more recent logs for the shutdown information. You can modify the /c:100 option with a different number to check more or fewer events.

4. Check each log description to determine the time and reason for the shutdown.

Once you complete the steps, you will understand why the computer was shut down or restarted unexpectedly.

If you use the PowerShell or Command Prompt option, you can also export the output to a text file with these instructions.

More Windows 10 resources

For more helpful articles, coverage, and answers to common questions about Windows 10, visit the following resources:

• Windows 10 on Windows Central — All you need to know
• Windows 10 help, tips, and tricks
• Windows 10 forums on Windows Central