Skip to main content

How to find out why your PC shut down for no reason on Windows 10

Windows 10 shutdown and restart logs
(Image credit: Future)

On Windows 10, the Event Log system tracks everything that happens, including when and why the computer restarts or shuts down correctly or due to a problem.

Typically, you don't think about reviewing this information as long as Windows 10 starts up again correctly. However, you may need to know these details to determine if there is an issue that needs attention. Or to understand if Windows Update suddenly rebooted to apply a cumulative update, or if the device lost power unexpectedly.

Whatever the reason might be, Windows 10 includes tools that allow you to check the date, time, and reason the system shut down or restarted unexpectedly using the Event Viewer or querying the event logs with PowerShell and Command Prompt.

This guide will show you the steps to check why the device shut down on Windows 10.

How to determine shutdown reason on Windows 10 with Event Viewer

To check the Event Viewer logs and determine why the device was shut down or restarted on Windows 10, use these steps:

  1. Open Start.
  2. Search for Event Viewer and click the top result to open the app.
  3. Browse the following path: Event Viewer > Windows Logs > System
  4. Right-click the System category and select the Filter Current Log option.

(Image credit: Future)
  1. In the "All Event ID" textbox, include the following ID numbers separated using a comma:
  • 41 — The device did not restart correctly using a clean shutdown first. This event could be caused if the computer stopped responding, crashed, or lost power unexpectedly.
  • 1074 — This event is triggered when the user initiates a manual shutdown or restart. Or when the system restarts automatically to apply updates, for example. If you were using the shutdown command with a custom message, the information would be recorded in the "Comment" section.
  • 6006 — This event is logged when the Event Log system has been stopped by during a good shutdown. This error usually happens after error 1074.
  • 6005 — This event is logged when the Event Log system started, which can indicate when the computer was booted.
  • 6008 — Indicates that the previous system shutdown was unexpected. This error will usually happen after error 41.

(Image credit: Future)
  • Quick note: The input should look like this: 41,1074,6006,6605,6008. Windows 10 logs many types of logs, these are just a few events you can use to diagnose the problem.
  1. Click the OK button.
  2. Double-click a log to confirm the information.
  • Quick tip: You can use the down and up keyboard arrows to browse between events. As you move between the logs, the details will appear at the bottom of the screen, in the "General" tab.

(Image credit: Future)

Once you complete the steps, the information will allow you to determine the time and the possible reason (such as Blue Screen of Death, crashed, unexpected power loss, etc.), which may have caused the reboot or shutdown.

Unless you can link these logs to another system component error log, it would be difficult to identify what exactly forced the unexpected shutdown. However, these events will help to understand what happened and where to continue looking.

How to determine shutdown reason on Windows 10 with PowerShell

To find out the reason Windows 10 shutdown with PowerShell, use these steps:

  1. Open Start.
  2. Search for PowerShell and click the top result to open the app.
  3. Type the following command to view the event logs and press Enter: Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 41, 1074, 6006, 6605, 6008; } | Format-List Id, LevelDisplayName, TimeCreated, Message

(Image credit: Future)
  1. Check the log information to determine the time and reason for the shutdown.

After you complete the steps, the events will indicate the date, time, and why Windows 10 was shut down or rebooted.

How to determine shutdown reason on Windows 10 with Command Prompt

To check why the computer shutdown with Command Prompt, use these steps:

  1. Open Start.
  2. Search for Command Prompt and click the top result to open the app.
  3. Type the following command to view the event logs and press Enter: wevtutil qe System /q:"*[System[(EventID=41) or (EventID=1074) or (EventID=6006) or (EventID=6005) or (EventID=6008)]]" /c:100 /f:text /rd:true 
  • Quick note: The above command will check the 100 more recent logs for the shutdown information. You can modify the "/c:100" option with a different number to check more or fewer events.

(Image credit: Future)
  1. Check each log description to determine the time and reason for the shutdown.

Once you complete the steps, you will understand why the computer was shut down or restarted unexpectedly.

If you use the PowerShell or Command Prompt option, you can also export the output to a text file with these instructions.

More Windows 10 resources

For more helpful articles, coverage, and answers to common questions about Windows 10, visit the following resources:

Mauro Huculak is technical writer for WindowsCentral.com. His primary focus is to write comprehensive how-tos to help users get the most out of Windows 10 and its many related technologies. He has an IT background with professional certifications from Microsoft, Cisco, and CompTIA, and he's a recognized member of the Microsoft MVP community.