Who restarted server ( Event ID 41,1074,6006,6605,6008 )

Sometimes, a server will restart before spending hours troubleshooting. Check if someone has restarted by reviewing the error logs for 41,1074,6006,6605,6008

PS C:\> Get-EventLog System -Newest 10000 | `

        Where EventId -in 41,1074,1076,6005,6006,6008,6009,6013 | `

        Format-Table TimeGenerated,EventId,UserName,Message -AutoSize -wrap

PS C:\> Get-EventLog System -Newest 10000 | `

Where EventId -in 41,1074,1076,6005,6006,6008,6009,6013 | `

Format-Table TimeGenerated,EventId,UserName,Message -AutoSize -wrap

Quick note: The input should look like this: 41,1074,6006,6605,6008.

In the "All Event ID" textbox, include the following ID numbers separated using a comma:

41 — The device did not restart correctly using a clean shutdown first. This event could be caused if the computer stopped responding, crashed, or lost power unexpectedly.

1074 — This event is triggered when the user initiates a manual shutdown or restart. Or when the system restarts automatically to apply updates, for example. If you were using the shutdown command with a custom message, the information would be recorded in the "Comment" section.

6006 — This event is logged when the Event Log system has been stopped by during a good shutdown. This error usually happens after error 1074.

6005 — This event was logged when the Event Log system started, which can indicate when the computer was started.

6008 — Indicates that the previous system shutdown was unexpected. This error will usually happen after error 41.

Quick note: The input should look like this: 41,1074,6006,6605,6008.

To find out the reason Windows 11 (or 10) shutdown with PowerShell, use thesesteps:

Open Start.

Search for PowerShell and click the top result to open the app.

Type the following command to view the event logs and press Enter: Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 41, 1074, 6006, 6605, 6008; } | Format-List Id, LevelDisplayName, TimeCreated, Message

To check why the computer shutdown with Command Prompt, use these steps:

Open Start.

Search for Command Prompt and click the top result to open the app.

Type the following command to view the event logs and press Enter: wevtutil qe System /q:"*[System[(EventID=41) or (EventID=1074) or (EventID=6006) or (EventID=6005) or (EventID=6008)]]" /c:100 /f:text /rd:true 

Quick note: The above command will check the 100 more recent logs for the shutdown information. You can modify the "/c:100" option with a different number to check more or fewer events.

Don't get to "clear filter" after and not "clear log" if you are using the Event Viewer GUI