Stay put for a tutorial to find the issue behind those annoying, random Windows 10/11 shutdowns.
Operating systems are complex entities carrying countless problems.
One of many issues that a Windows user might have to brave against is random shutdowns. This doesn’t have any set frequency and can occur from sometimes a day to a few minutes gap.
From hardware to software, Microsoft forums are full of ‘possible’ solutions to this agony. Still, some users are left with nothing but a hope that the next trick might just work.
So, today we aren’t troubleshooting as we have done in the past with Unexpected Store Exception, Display Driver nvlddmkm Stopped Responding, etc.
Instead, due to the nature of the problem at hand, this article is just about finding the root cause in different ways, without the actual remedy.
And please note that the screenshots are from Windows 10. However, the steps are identical, and we’ve verified them on Windows 11.
Let’s start with the first.
Event Viewer
Event Viewer is the logbook of your Windows PC. You’ll see information regarding various applications, updating, errors, etc. However, not everything is important from an average user’s point of view.
Still, this can assist in checking out the problem that triggered the last shutdown and the ones prior to that.
First, press ⊞ X, followed by V, to open the Event Viewer.
Subsequently, navigate to Windows Logs > System > Filter Current Log…
The filtering is to see only the entries related to the shutdown. So we’ll filter for these event ids:
| Event Id | Description |
| 41 | The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly. |
| 1074 | When an app or user initiates a system shutdown or restart. This usually precedes the next event ID: 6006. |
| 6006 | Indicates a proper shutdown with a message ‘The Event log service was stopped.’ |
| 6008 | Logged as an abrupt shutdown with the message ‘The previous system shutdown at TIME on DATE was unexpected.’ |
Enter these event IDs and press OK to get the screened results.
One can also filter the IDs by time and troubleshoot Windows random shutdown accordingly. All entries indicate the exact time of occurrence and the responsible application.
PowerShell
There is a geeky way to do it if you don’t want to dabble inside the Windows Event Viewer.
To get started with this, search for PowerShell in the taskbar search and open the appropriate application.
Now copy this code, paste, and press enter to fetch the relevant information from the Windows logs.
Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 41, 1074, 6006, 6008; } |
Format-List Id, LevelDisplayName, TimeCreated, Message
This is similar to the Event Viewer, with the only difference being the way of presentation. And likewise, the Message row in each entry states the reason for the specific event.
Command Prompt
You can do a similar operation in Command Prompt, a frequently-used, less powerful version of PowerShell.
Type CMD in the taskbar search and open Command Prompt.
Next, copy-paste the following code in the CMD window and hit enter.
wevtutil qe System /q:"*[System[(EventID=41) or (EventID=1074) or (EventID=6006) or
(EventID=6008)]]" /c:50 /f:text /rd:true
This will give you the latest 50 entries. However, you can change the number in c:50 as per the requirement to get more or less.
Conclusion
So these were a few in-built applications to get Windows random shutdown-related queries from the event log.
While the PowerShell and the Command Prompt can do the job just fine, the Event Viewer is infinitely more user-friendly to browse through the events. And as already stated, except for different looks, these will work the same in both the Windows versions.
Finally, when you get the hold of it, it’s time to scramble through the Microsoft Community for a fix. If you don’t find your problem listed there, it’s best to start a thread and get the help you need. And if nothing works, try contacting Microsoft support.
