Geekflare is supported by our audience. We may earn affiliate commissions from buying links on this site.
In Windows Last updated: April 13, 2023
Share on:
Invicti Web Application Security Scanner – the only solution that delivers automatic verification of vulnerabilities with Proof-Based Scanning™.

Stay put for a tutorial to find the issue behind those annoying, random Windows 10/11 shutdowns.

Operating systems are complex entities carrying countless problems.

One of many issues that a Windows user might have to brave against is random shutdowns. This doesn’t have any set frequency and can occur from sometimes a day to a few minutes gap.

From hardware to software, Microsoft forums are full of ‘possible’ solutions to this agony. Still, some users are left with nothing but a hope that the next trick might just work.

So, today we aren’t troubleshooting as we have done in the past with Unexpected Store Exception, Display Driver nvlddmkm Stopped Responding, etc.

Instead, due to the nature of the problem at hand, this article is just about finding the root cause in different ways, without the actual remedy.

And please note that the screenshots are from Windows 10. However, the steps are identical, and we’ve verified them on Windows 11.

Let’s start with the first.

Event Viewer

Event Viewer is the logbook of your Windows PC. You’ll see information regarding various applications, updating, errors, etc. However, not everything is important from an average user’s point of view.

Still, this can assist in checking out the problem that triggered the last shutdown and the ones prior to that.

event viewer

First, press ⊞+X, followed by V, to open the Event Viewer.

Subsequently, navigate to Windows Logs > System > Filter Current Log…

event viewer to troubleshoot windows random shutdown

The filtering is to see only the entries related to the shutdown. So we’ll filter for these event ids:

Event IdDescription
41The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
1074When an app or user initiates a system shutdown or restart. This usually precedes the next event ID: 6006.
6006Indicates a proper shutdown with a message ‘The Event log service was stopped.’
6008Logged as an abrupt shutdown with the message ‘The previous system shutdown at TIME on ‎DATE was unexpected.’

Enter these event IDs and press OK to get the screened results.

filtering events log

One can also filter the IDs by time and troubleshoot Windows random shutdown accordingly. All entries indicate the exact time of occurrence and the responsible application.

checking problems causing windows random shut down


There is a geeky way to do it if you don’t want to dabble inside the Windows Event Viewer.

To get started with this, search for PowerShell in the taskbar search and open the appropriate application.

open powershell

Now copy this code, paste, and press enter to fetch the relevant information from the Windows logs.

Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 41, 1074, 6006, 6008; } | 
Format-List Id, LevelDisplayName, TimeCreated, Message
powershell windows random shutdown troubleshooting

This is similar to the Event Viewer, with the only difference being the way of presentation. And likewise, the Message row in each entry states the reason for the specific event.

Command Prompt

You can do a similar operation in Command Prompt, a frequently-used, less powerful version of PowerShell.

Type CMD in the taskbar search and open Command Prompt.

Next, copy-paste the following code in the CMD window and hit enter.

wevtutil qe System /q:"*[System[(EventID=41) or (EventID=1074) or (EventID=6006) or 
(EventID=6008)]]" /c:50 /f:text /rd:true
command prompt windows random shutdown troubleshooting

This will give you the latest 50 entries. However, you can change the number in c:50 as per the requirement to get more or less.


So these were a few in-built applications to get Windows random shutdown-related queries from the event log.

While the PowerShell and the Command Prompt can do the job just fine, the Event Viewer is infinitely more user-friendly to browse through the events. And as already stated, except for different looks, these will work the same in both the Windows versions.

Finally, when you get the hold of it, it’s time to scramble through the Microsoft Community for a fix. If you don’t find your problem listed there, it’s best to start a thread and get the help you need. And if nothing works, try contacting Microsoft support.

Next, learn how to solve the blue screen error in Windows.

  • Hitesh Sant
    Hitesh works as a senior writer at Geekflare and dabbles in cybersecurity, productivity, games, and marketing. Besides, he holds master’s in transportation engineering. His free time is mostly about playing with his son, reading, or lying… read more
Thanks to our Sponsors
More great readings on Windows
Power Your Business
Some of the tools and services to help your business grow.
  • Invicti uses the Proof-Based Scanning™ to automatically verify the identified vulnerabilities and generate actionable results within just hours.
    Try Invicti
  • Web scraping, residential proxy, proxy manager, web unlocker, search engine crawler, and all you need to collect web data.
    Try Brightdata
  • is an all-in-one work OS to help you manage projects, tasks, work, sales, CRM, operations, workflows, and more.
    Try Monday
  • Intruder is an online vulnerability scanner that finds cyber security weaknesses in your infrastructure, to avoid costly data breaches.
    Try Intruder