How to Find the Unexpected Shutdowns events in Windows 11 and Their reasons

When your system shuts down unexpectedly, it’s very natural for you to wonder whether this is the first time it has ever happened. It could also pique your interest on why this happened suddenly. Luckily, Windows has a great inbuilt service called Event viewer which can give you all the information you require in this regard.

This article explains in detail how you can view all the shutdowns that happened in your machine along with their event times. You can also filter these shutdowns and get details of only the unexpected shutdowns as well.

Step 1: Launch the Run window by pressing WIN + R hotkey combination. Type in eventvwr.msc and hit the OK button.

 



1 Run Event Viewer Optimized

 

Step 2: When the Event Viewer window opens up,

  1. Double click on Windows Logs in the left window pane to expand it.
  2. As next, click on the System subsection.
  3. Finally, on the right pane of the window, click on the Filter Current Log option.

 

2 Filter Current Log Optimized

 

Step 3: Filter Current Log window would now launch. Choose User32 as Event sources as shown in the screenshot below. Also, type in 1074 in the <All Event IDs> text box. Once you are done, hit OK button to apply the filter.

Note: 1074 event Id is for all the events when the system got shut down because of manual actions. That is if the user did the shutdown. 1074 could also get logged if the system automatically restarts itself to update your computer with the latest system updates.

 

3 User32 Optimized

 

Step 4: Now in the centre pane of the Event Viewer window, under the System section, you can see all the events where the Event ID was 1074, i.e., manual shutdowns.

Below the System section, choose the General tab. Here you can see which user initiated the shutdown. You can also easily figure out the date and time of the shutdown.

 

4 General Details Optimized

 

Step 5: Now if you want to know only about the unexpected shutdowns that happened in your machine, in the Filter Current Log window in Step 3, clear the Event sources drop-down field. And type in 6008 in the <All Event IDs> text field. Once you are done, hit Ok button.

 

5 Filter Unexpected Optimized

 

Step 6: 6008 Event ID corresponds to the unexpected shutdowns that happened in your machine. Here you can easily find out how many times your system got shut down unexpectedly and on which all dates the unexpected shutdowns happened.

As for the cause of the error, sometimes you will get some information from the General tab below.



Mostly the reason for unexpected shutdowns is because of a system crash, running out of power or could even be because of a non-responsive system state.

 

6 Unexpected Optimized

 

We hope you found the information you were looking for. Thank you for reading.