Is there something that can tell me Windows did not shutdown normally? Like when someone has unplugged the power or pressed the hardware power button?

  • 3
    Are you asking if there is a log? Yes it's under administrative tools, then computer managment, event viewer. I believe it would be under system logs. Feb 9 '18 at 3:13
  • 2
    Note that on most modern machines, the "hardware" power button will just send a signal to the OS, and the OS can respond however it wants, usually by performing a normal shutdown, sleep, hibernate, or just ignoring it altogether. Feb 9 '18 at 14:21
  • ...unless you hold the power button, which on most systems causes a forced shutdown the OS cannot veto. Feb 9 '18 at 15:50

Yes, an abnormal shutdown is recorded in the System event log during the next system boot. It will be logged with event ID 6008 from the source Eventlog. Here's a sample event entry:

Source: Event Log 
Type: Error
The previous system shutdown at Time on
Date was unexpected.

Time and Date will be replaced with the time of the unexpected shutdown.

If the shutdown was caused by a Bugcheck (i.e. Blue screen error) a corresponding event ID 1001 will be logged from the source Bugcheck. It will contain the Stop code and some minimal additional troubleshooting data. Here's what the text of that event looks like:

The computer has rebooted from a bugcheck. The bugcheck was: 0x00000124 (0x0000000000000000, 0xfffffa8004b19038, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\Windows\Minidump\112809-21309-01.dmp. Report Id: 112809-21309-01.


You can look up the Bugcheck/Stop code (0x124 in the above example) on MSDN where you'll find information about each code and how to interpret the four additional parameters included with the error information.


A shutdown is considered abnormal if the application receives an immediate shut down signal from the operating system and does not get a chance to complete shutdown processing.

An alternative good way to get a good glimpse of what happened after an abnormal shutdown is using Nirsoft's TurnedOnTimesView.

TurnedOnTimesView is a simple tool that analyses the event log of Windows operating system, and detects the time ranges that your computer was turned on.

For every period of time that the computer was turned on, the following information is displayed: Startup Time, Shutdown Time, Duration, Shutdown Reason, Shutdown Type, Shutdown Process, and Shutdown Code. TurnedOnTimesView allows you to get this information from your local computer, and from remote computer on your network if you have enough privilege to read the event log of Windows remotely.

enter image description here

Credits: NirSoft®

You could also use Windows Performance Analyzer and Recorder tool (from Windows SDK)

After finished installation, run Windows Performance Recorder shortcut from the start menu.

Set the options according to the screenshot below and click the Start button.

  • Performance scenario: Shutdown
  • Detail level: Verbose
  • Logging mode: File
  • Number of iterations: 1

enter image description here

When Windows is restarted, Windows Performance Recorder will automatically start gathering system shutdown trace information. Once it is done, click the Open in WPA button.

Read More: How To Troubleshoot Windows Startup, LogOff, Login and Shutdown Problems

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.