Windows Shutdown and Restart Event IDs

The event IDs that can be searched on in windows event viewer for the confirmation of shutdown or restart.

Event ID Name Description
14 The system has rebooted without cleanly shutting down first This event indicates that some unexpected activity prevented Windows from shutting down correctly. Such a shutdown might be caused by an interruption in the power supply or by a Stop error. If feasible, Windows records any error codes as it shuts down.
1074 System has been shutdown by a process/user. This event is written when an application causes the system to restart, or when the user initiates a restart or shutdown by clicking Start or pressing CTRL+ALT+DELETE, and then clicking Shut Down.
6006 The event log service was stopped. The event is logged at boot time noting that the Event Log service was stopped.
6008 Unexpected system shutdown The previous system shutdown at Time on
Date was unexpected.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.