# Event Viwer - Look at a Machine Restart

<div aria-level="3" class="otQkpb" data-animation-nesting="" data-sfc-cb="" data-sfc-cp="" data-sfc-root="c" id="bkmrk-key-event-ids-for-re" jsaction="" jscontroller="a7qCn" jsuid="xPB4Ib_u" role="heading">Key Event IDs for Reboot Analysis<span class="txxDge notranslate" data-sfc-cb="" data-sfc-root="c" data-wiz-uids="xPB4Ib_w,xPB4Ib_x"><span class="vKEkVd" data-animation-atomic="" data-wiz-attrbind="class=xPB4Ib_v/TKHnVd"><button aria-label="View related links" class="rBl3me" data-amic="true" data-hveid="CAEIABAM" data-icl-uuid="2bad5278-8f27-4f6d-82c2-78cb80fe7108" data-ved="2ahUKEwj7taODn8WTAxXDDzQIHX4zM-8Qye0OegYIAQgAEAw" data-wiz-attrbind="disabled=xPB4Ib_v/C5gNJc;aria-label=xPB4Ib_v/bOjMyf;class=xPB4Ib_v/UpSNec" tabindex="0"><span class="wiMplc ofC0Ud"><svg fill="currentColor" focusable="false" height="12px" viewbox="0 0 24 24" width="12px" xmlns="http://www.w3.org/2000/svg"><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z"></path></svg></span></button></span></span></div>- <span class="T286Pc" data-sfc-cb="" data-sfc-cp="" data-sfc-root="c">**<span data-sfc-cb="" data-sfc-root="c" data-wiz-uids="xPB4Ib_13">[1074](https://www.google.com/search?q=1074&sca_esv=d22b1170cb5b1f6e&rlz=1C1GCEA_enUS1140US1140&sxsrf=ANbL-n72-uXVeB8qeAGXZWrFvhkjveTwdQ%3A1774791741122&ei=PSzJab-NB-aCp84P_o65gAw&biw=1920&bih=911&ved=2ahUKEwj7taODn8WTAxXDDzQIHX4zM-8QgK4QegYIAQgAEA4&uact=5&oq=restart+code+in+event+viewer&gs_lp=Egxnd3Mtd2l6LXNlcnAiHHJlc3RhcnQgY29kZSBpbiBldmVudCB2aWV3ZXIyBRAAGIAEMgYQABgFGB4yBhAAGAUYHjIGEAAYBRgeMgsQABiABBiKBRiGAzIIEAAYiQUYogQyCBAAGIkFGKIESPsXUIUJWJ0WcAJ4AZABAJgBhQGgAegHqgEDMC44uAEDyAEA-AEBmAIKoAKNCMICChAAGEcY1gQYsAPCAgYQABgHGB7CAggQABgFGAcYHsICCBAAGIAEGKIEwgIFEAAY7wWYAwCIBgGQBgiSBwMyLjigB8gwsgcDMC44uAeDCMIHBTAuNy4zyAcagAgB&sclient=gws-wiz-serp)</span> (Planned):** Indicates a user or application initiated a restart or shutdown. It shows who did it and why.</span>
- <span class="T286Pc" data-sfc-cb="" data-sfc-cp="" data-sfc-root="c">**<span data-sfc-cb="" data-sfc-root="c" data-wiz-uids="xPB4Ib_18">[41](https://www.google.com/search?q=41&sca_esv=d22b1170cb5b1f6e&rlz=1C1GCEA_enUS1140US1140&sxsrf=ANbL-n72-uXVeB8qeAGXZWrFvhkjveTwdQ%3A1774791741122&ei=PSzJab-NB-aCp84P_o65gAw&biw=1920&bih=911&ved=2ahUKEwj7taODn8WTAxXDDzQIHX4zM-8QgK4QegYIAQgAEBA&uact=5&oq=restart+code+in+event+viewer&gs_lp=Egxnd3Mtd2l6LXNlcnAiHHJlc3RhcnQgY29kZSBpbiBldmVudCB2aWV3ZXIyBRAAGIAEMgYQABgFGB4yBhAAGAUYHjIGEAAYBRgeMgsQABiABBiKBRiGAzIIEAAYiQUYogQyCBAAGIkFGKIESPsXUIUJWJ0WcAJ4AZABAJgBhQGgAegHqgEDMC44uAEDyAEA-AEBmAIKoAKNCMICChAAGEcY1gQYsAPCAgYQABgHGB7CAggQABgFGAcYHsICCBAAGIAEGKIEwgIFEAAY7wWYAwCIBgGQBgiSBwMyLjigB8gwsgcDMC44uAeDCMIHBTAuNy4zyAcagAgB&sclient=gws-wiz-serp)</span> (Unexpected):** The system rebooted without a clean shutdown, often due to power failure or a system crash.</span>
- <span class="T286Pc" data-sfc-cb="" data-sfc-cp="" data-sfc-root="c">**<span data-sfc-cb="" data-sfc-root="c" data-wiz-uids="xPB4Ib_1d">[6008](https://www.google.com/search?q=6008&sca_esv=d22b1170cb5b1f6e&rlz=1C1GCEA_enUS1140US1140&sxsrf=ANbL-n72-uXVeB8qeAGXZWrFvhkjveTwdQ%3A1774791741122&ei=PSzJab-NB-aCp84P_o65gAw&biw=1920&bih=911&ved=2ahUKEwj7taODn8WTAxXDDzQIHX4zM-8QgK4QegYIAQgAEBI&uact=5&oq=restart+code+in+event+viewer&gs_lp=Egxnd3Mtd2l6LXNlcnAiHHJlc3RhcnQgY29kZSBpbiBldmVudCB2aWV3ZXIyBRAAGIAEMgYQABgFGB4yBhAAGAUYHjIGEAAYBRgeMgsQABiABBiKBRiGAzIIEAAYiQUYogQyCBAAGIkFGKIESPsXUIUJWJ0WcAJ4AZABAJgBhQGgAegHqgEDMC44uAEDyAEA-AEBmAIKoAKNCMICChAAGEcY1gQYsAPCAgYQABgHGB7CAggQABgFGAcYHsICCBAAGIAEGKIEwgIFEAAY7wWYAwCIBgGQBgiSBwMyLjigB8gwsgcDMC44uAeDCMIHBTAuNy4zyAcagAgB&sclient=gws-wiz-serp)</span>**</span><div id="bkmrk-%C2%A0%28unexpected%29%3A"> (Unexpected):</div><div id="bkmrk-%C2%A0indicates-an-abnorm"> Indicates an abnormal or "dirty" shutdown occurred, often preceding event 41.</div>
- <div id="bkmrk-6005%C2%A0%28startup%29%3A%C2%A0reco"><span class="T286Pc" data-sfc-cb="" data-sfc-cp="" data-sfc-root="c">**<span data-sfc-cb="" data-sfc-root="c" data-wiz-uids="xPB4Ib_5r">[6005](https://www.google.com/search?q=6005&sca_esv=d22b1170cb5b1f6e&rlz=1C1GCEA_enUS1140US1140&sxsrf=ANbL-n72-uXVeB8qeAGXZWrFvhkjveTwdQ%3A1774791741122&ei=PSzJab-NB-aCp84P_o65gAw&biw=1920&bih=911&ved=2ahUKEwj7taODn8WTAxXDDzQIHX4zM-8QgK4QegYIAQgCEAE&uact=5&oq=restart+code+in+event+viewer&gs_lp=Egxnd3Mtd2l6LXNlcnAiHHJlc3RhcnQgY29kZSBpbiBldmVudCB2aWV3ZXIyBRAAGIAEMgYQABgFGB4yBhAAGAUYHjIGEAAYBRgeMgsQABiABBiKBRiGAzIIEAAYiQUYogQyCBAAGIkFGKIESPsXUIUJWJ0WcAJ4AZABAJgBhQGgAegHqgEDMC44uAEDyAEA-AEBmAIKoAKNCMICChAAGEcY1gQYsAPCAgYQABgHGB7CAggQABgFGAcYHsICCBAAGIAEGKIEwgIFEAAY7wWYAwCIBgGQBgiSBwMyLjigB8gwsgcDMC44uAeDCMIHBTAuNy4zyAcagAgB&sclient=gws-wiz-serp)</span> (Startup):** Recorded when the Event Log service starts, signifying the system has booted up.</span><span class="T286Pc" data-sfc-cb="" data-sfc-cp="" data-sfc-root="c">**<span data-sfc-cb="" data-sfc-root="c" data-wiz-uids="xPB4Ib_5w">[6006](https://www.google.com/search?q=6006&sca_esv=d22b1170cb5b1f6e&rlz=1C1GCEA_enUS1140US1140&sxsrf=ANbL-n72-uXVeB8qeAGXZWrFvhkjveTwdQ%3A1774791741122&ei=PSzJab-NB-aCp84P_o65gAw&biw=1920&bih=911&ved=2ahUKEwj7taODn8WTAxXDDzQIHX4zM-8QgK4QegYIAQgCEAM&uact=5&oq=restart+code+in+event+viewer&gs_lp=Egxnd3Mtd2l6LXNlcnAiHHJlc3RhcnQgY29kZSBpbiBldmVudCB2aWV3ZXIyBRAAGIAEMgYQABgFGB4yBhAAGAUYHjIGEAAYBRgeMgsQABiABBiKBRiGAzIIEAAYiQUYogQyCBAAGIkFGKIESPsXUIUJWJ0WcAJ4AZABAJgBhQGgAegHqgEDMC44uAEDyAEA-AEBmAIKoAKNCMICChAAGEcY1gQYsAPCAgYQABgHGB7CAggQABgFGAcYHsICCBAAGIAEGKIEwgIFEAAY7wWYAwCIBgGQBgiSBwMyLjigB8gwsgcDMC44uAeDCMIHBTAuNy4zyAcagAgB&sclient=gws-wiz-serp)</span> (Clean Shutdown):** Recorded when the system shuts down properly.</span></div>

<div aria-level="3" class="otQkpb" data-animation-nesting="" data-sfc-cb="" data-sfc-cp="" data-sfc-root="c" id="bkmrk-how-to-find-these-ev" jsaction="" jscontroller="a7qCn" jsuid="xPB4Ib_3y" role="heading">How to Find These Events<span class="txxDge notranslate" data-sfc-cb="" data-sfc-root="c" data-wiz-uids="xPB4Ib_40,xPB4Ib_41"><span class="vKEkVd" data-animation-atomic="" data-wiz-attrbind="class=xPB4Ib_3z/TKHnVd"><button aria-label="View related links" class="rBl3me" data-amic="true" data-hveid="CAEIARAA" data-icl-uuid="0b25435b-2aec-4214-bf8b-4dbb1fbb3b4b" data-ved="2ahUKEwj7taODn8WTAxXDDzQIHX4zM-8Qye0OegYIAQgBEAA" data-wiz-attrbind="disabled=xPB4Ib_3z/C5gNJc;aria-label=xPB4Ib_3z/bOjMyf;class=xPB4Ib_3z/UpSNec" tabindex="0"><span class="wiMplc ofC0Ud"><svg fill="currentColor" focusable="false" height="12px" viewbox="0 0 24 24" width="12px" xmlns="http://www.w3.org/2000/svg"><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z"></path></svg></span></button></span></span></div>1. <span class="T286Pc" data-sfc-cb="" data-sfc-cp="" data-sfc-root="c">Press `Win + R`, type `eventvwr`, and hit Enter.</span>
2. <span class="T286Pc" data-sfc-cb="" data-sfc-cp="" data-sfc-root="c">Expand **Windows Logs** and select **System**.</span>
3. <span class="T286Pc" data-sfc-cb="" data-sfc-cp="" data-sfc-root="c">Click **Filter Current Log...** in the right pane.</span>
4. <span class="T286Pc" data-sfc-cb="" data-sfc-cp="" data-sfc-root="c">In the `<All Event IDs>` box, type the desired IDs separated by commas (e.g., `41, 1074, 6008, 6006`).</span>

<div aria-level="3" class="otQkpb" data-animation-nesting="" data-sfc-cb="" data-sfc-cp="" data-sfc-root="c" id="bkmrk-powershell-command-f" jsaction="" jscontroller="a7qCn" jsuid="xPB4Ib_4o" role="heading">PowerShell Command for Quick Check<span class="uJ19be notranslate" data-sfc-cb="" data-sfc-root="c" data-wiz-uids="xPB4Ib_4q,xPB4Ib_4r"><span class="vKEkVd" data-animation-atomic="" data-wiz-attrbind="class=xPB4Ib_4p/TKHnVd"><span aria-hidden="true"> </span><button aria-label="View related links" class="rBl3me" data-amic="true" data-hveid="CAEIARAH" data-icl-uuid="2a2359f5-823b-4d02-84f2-a7edd9facb7a" data-ved="2ahUKEwj7taODn8WTAxXDDzQIHX4zM-8Qye0OegYIAQgBEAc" data-wiz-attrbind="disabled=xPB4Ib_4p/C5gNJc;aria-label=xPB4Ib_4p/bOjMyf;class=xPB4Ib_4p/UpSNec" tabindex="0"><span class="wiMplc ofC0Ud"><svg fill="currentColor" focusable="false" height="12px" viewbox="0 0 24 24" width="12px" xmlns="http://www.w3.org/2000/svg"><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z"></path></svg></span></button></span></span></div><div class="Y3BBE" data-hveid="CAEIARAI" data-sfc-cb="" data-sfc-cp="" data-sfc-root="c" id="bkmrk-use-this-command-to-" jsaction="rcuQ6b:&xPB4Ib_4s|npT2md" jscontroller="zcfIf" jsuid="xPB4Ib_4s">Use this command to quickly list recent restart events:</div>```powershell
Get-WinEvent -FilterHashTable @{LogName='System';ID=1074,6006,6008,41} | Select-Time -Property TimeCreated, Id, Message | Format-Table -Wrap
```