Any restart or shutdown of your computer, whether it was performed routinely or because of an error, will be recorded in Windows 10’s Event Log. If Windows 10 restarts normally, you probably won’t think twice about analyzing this data. Nevertheless, these specifics may be required for you to ascertain the existence of a problem requiring your prompt action. The purpose of this article is to provide a quick overview of the means on how to check why Windows restarted.
Processes of Checking Why Windows Restarted
You may examine the date, time, and reasons why the device abruptly closed down or resumed by utilizing the Event Viewer or searching the event logs using PowerShell or Command Prompt in Windows 10. These tools are included in Windows 10 and can be used regardless of the cause for the untimely downtime or reboot.
Using Event Viewer
Here’s how to access Windows 10’s Event Viewer records and learn information regarding why your system crashed:
Launch Start menu. Conduct a search for Event Viewer, and when you find it, select the very first result to launch the application. After launching the Event Viewer, navigate to the Windows Logs folder, and once there, choose System from the menu. To narrow the present log, right-click the System category & choose the choice to Filter Current Log.
Separate each ID number with a comma and enter them one by one into the “All Event ID” input field.
- Event 41– The system did not properly resume after a complete shutdown. Reasons for this might be anything from a sudden loss of electricity to the computer’s inability to process any new input.
- Event 1074– With event 1074, the user is responsible for causing the system to shut down or restart manually. Also, when the machine restarts itself for whatever reason (like installing updates), this might happen. When issuing a shutdown instruction with an optional message, that text will be saved in the “Comment” field.
- Event 6006– This is recorded whenever a proper shutdown occurs and the Event Log service is terminated. As a rule, this problem occurs after 1074.
- Event 6005– It is possible to determine the time the machine was booted from this event, which is recorded whenever the Event Log service was opened.
- Event 6008– A 6008 code means the last system shutdown was unanticipated. This error occurs after error 41 has already occurred.
A quick reminder: the correct format for the input is 41,1074,6006,6605,6008. These occurrences are only a small subset of the various logs created by Windows 10, which might be used for troubleshooting.
It’s safe to proceed by selecting the OK option. Simply double-clicking a log will verify its contents. You may use the keyboard’s arrow buttons to quickly advance to a specific time or event. Clicking on the logs will bring up further information in the “General” tab at the end of the window.
Upon completion of the processes, you will have the data necessary to ascertain when and why the restart or shutdown occurred (for example, a Blue Display of Death, a malfunction, an unanticipated loss of electricity, etc.).
It is unlikely that the cause of the abrupt shutdown can be determined from these logs alone; linking them to the error logs of other system components is necessary. These developments, nevertheless, will aid in making sense of what occurred and directing future investigations.
Using PowerShell
Follow these instructions to utilize PowerShell to determine the cause of a Windows 10 shutdown:
Launch Start menu. Try it out now by typing “PowerShell” into a search field and selecting the first result to launch the program. The event records may be seen by typing the following code and hitting Enter:
Get-Winevent – Filterhashtable @{ logName = ‘System’; Id = 41, 1074, 6006, 6605, 6008; } |
Format-list id, Leveldisplayname, TimeCreated, Message
Find out when the system went down and why by looking at the logs. Once you’ve executed the instructions, you’ll be able to view the time and reason Windows 10 was closed down or restarted.
Using Command Prompt
Here’s how to use Command Prompt to figure out what triggered your machine to power down:
Start It Up. Enter “Command Prompt” into the search bar and pick the initial match to run the application. The event logs may be viewed by typing the following instruction and hitting Enter:
This instruction will search the 100 most recent records for shutdown details. Changing the value of the “/c:100” option may be used to do a more thorough or cursory examination of the events being monitored.
Examine each log report to establish the timing and cause for the shutdown. When you’re done, you’ll know exactly why your computer crashed and restarted without warning.
If you prefer to work with PowerShell or the Command Prompt, you may follow these steps to save the results as a text file.
Conclusion
Random computer restarts or shutdowns might be serious, or they could be completely harmless. The machine may restart automatically for upgrades, but it may also restart for some reason that needs your attention. This post explains how to check why Windows restarted, so maybe it will be useful!