This tutorial will show you how to find and read all restart and shutdown logs in Event Viewer in Windows 10 and Windows 11.
You can use Event Viewer to view the date, time, and user details of all restart and shutdown event logs.
The event ID's below will show you these details.
Event ID | Description |
|---|---|
| 41 | The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly. |
| 1074 | Logged when an app (ex: Windows Update) causes the system to restart, or when a user initiates a restart or shutdown. |
| 6006 | Logged as a clean shutdown. It gives the message "The Event log service was stopped". |
| 6008 | Logged as a dirty shutdown. It gives the message "The previous system shutdown at time on date was unexpected". |
Here's How:
1 Open Event Viewer (eventvwr.msc).
2 In the left pane of Event Viewer, expand open Windows Logs, click/tap on System to open it, right click on System, and click/tap on Filter Current Log. (see screenshot below)
If you have already filtered this log, click/tap on Clear Filter first and then click/tap on Filter Current Log to start over.
3 Copy and paste the event ID's below into the <All Event IDs> field, and click/tap on OK. (see screenshot below)
41, 1074, 6006, 60084 You can now view the details of these restart and shutdown event logs filtered by these event IDs. (see screenshots below)
5 When finished viewing log details, you can close Event Viewer if you like.
That's it,
Shawn Brink
