19

I am using Windows 7. For some reason my PC just shut down and restarted itself. I did not receive any warnings or indication of this. Is there a way to find out why my PC just restarted?

14
  • Right click 'My Computer' and select manage. The event Viewer will give you a way to look at the event, error, system, and other logs. – cliff2310 Jun 10 '14 at 22:23
  • 3
    where is 'My Computer' – Vader Jun 10 '14 at 22:30
  • Disable the option to automatically restart upon system failure in the Startup and Recovery options. Then wait to see if a BSOD occurs. – joeqwerty Jun 10 '14 at 22:56
  • 1
    To open the Event Viewer you can press Win+R, type eventvwr.msc in the text box, and then press Enter. – and31415 Jun 10 '14 at 22:58
  • @and31415 I get an error i.imgur.com/z0ua3Iw.png – Vader Jun 10 '14 at 23:01
22

These are the Event ID's I found helpful in tracking down a Reboot:

Event ID 1074 (Source: USER32) is "...has initiated the restart..."
Event ID 6005 (Source: EventLog) is "Event Log Service was Started".
Event ID 6006 (Source: EventLog) is "Event Log Service was Stopped".
Event ID 7001 (Source: WinLogon) is "User Logon".
Event ID 7002 (Source: WinLogon) is "User Logoff".

6005 is a good indicator the computer is Booting/Powering Up.
6006 is a good indicator the computer is Rebooting/Shutting Down.


1074 is what I see when something has triggered a reboot of my system (usually a windows update).
Example:

The process C:\Windows\CCM\CcmExec.exe (SomeComputerName) has initiated the restart of computer SomeComputerName on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
Reason Code: 0x80020001
Shutdown Type: restart
Comment: Your computer will restart at 01/07/2017 08:14:38 PM to complete the installation of applications and software updates.

Online the description for 1074 reads:

This event is written when an application causes the system to restart, or when the user initiates a restart or shutdown by clicking Start or pressing CTRL+ALT+DELETE, and then clicking Shut Down.


My log has a bunch of Informational Event ID's for 7036, so I chose to ignore those (as noise).
For the "Filter Current Log..." I punched this in to Include/Exclude the following:

-7036,1074,6005,6006,7001,7002

On my machine, I saw this:
enter image description here

A reboot notice went out at 6:14pm (while I was away at dinner).
The machine logged me out at 8:15pm.
The machine powered down at 8:16pm.
The machine powered up at 8:17pm (which is indicative of a Warm Reboot).
When I returned home from dinner and a movie, I logged back in at 8:59pm.

This is how I knew our IT had set up a policy that was only giving me a 2-hour notice for a reboot.
Your reasons for a reboot may be different, so jot down these times and look for anything logged around those times.

1
  • Thanks, it was Windows 10 auto update in my case... – Mike Oct 18 '18 at 8:18
2

Nirsoft's free tool, TurnedOnTimesView, displays reasons. enter image description here

0

Check event viewer. Open up your start menu on the task bar, and type in "Event Viewer" (without the quotes) in the box that says "search programs and files" and press enter. When you have event viewer open, on the left side click the arrow by "Windows Logs". You will most likely find your reboot in "System".

0

The answer from MikeTeeVee is already a good starting place, however you also might want to include some of the Kernel-Power and Kernel-General events (12,13,89,109,41,42).

These are respectively: operating system start, operating system shutdown, power manager shutdown, reboot without clean shutdown, idle system entering sleep, sleep operation failed. These certainly have some overlap with the Event IDs already provided, but these may add additional context if needed.

The combined Include/Exclude Event IDs field:

-7036,1074,6005,6006,7001,7002,6008,12,13,109,41,42,43,1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.