🛠️ ITBlogs.pro

Why Did Windows Restart or Crash? Event Viewer and PowerShell Guide

Oct 16, 2026 · Windows · 4 min read

Your PC rebooted by itself, showed a blue screen, or shut down with no warning. Windows records what happened, so you don't have to guess. Here's how to read it.

Fastest view: Reliability Monitor

Press Win+R, type perfmon /rel, press Enter.

It shows a timeline with a red ✕ for each crash or failure, with plain-language descriptions ("Windows was not properly shut down", "Hardware error"). Click a day and View technical details. Start here.

Event Viewer

Open it with Win+R → eventvwr.msc, then go to Windows Logs → System and use Filter Current Log with these event IDs:

Event ID Source Meaning
41 Kernel-Power The system rebooted without cleanly shutting down: crash, power loss or hard freeze
1001 BugCheck A blue screen happened. The stop code is in the message
6008 EventLog The previous shutdown was unexpected
1074 User32 A shutdown or restart was requested by a user or program. The message tells you which process and the reason
6005 / 6006 EventLog Event log service started / stopped (marks boot and clean shutdown)
19 / 43 WindowsUpdateClient Update installed / installation started (a common reason for restarts)

Read the log from the bottom up: look at what happened in the minutes before the first Event 41. Warnings from the disk, Ntfs, volmgr, WHEA-Logger or a driver often appear just before a crash.

The same thing in PowerShell

Last 30 shutdown-related events:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,1001,1074,6005,6006,6008} -MaxEvents 30 |
  Format-Table TimeCreated, Id, ProviderName, Message -Wrap

Who or what requested the last restart:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 5 | Format-List TimeCreated, Message

Show only the problem events from the last 7 days:

Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2; StartTime=(Get-Date).AddDays(-7)} |
  Select TimeCreated, Id, ProviderName, Message | Format-Table -Wrap

(Level 1 = Critical, 2 = Error.)

If it was a blue screen

Windows saves a minidump in C:\Windows\Minidump (and a full dump in C:\Windows\MEMORY.DMP if enabled). Check that dumps are enabled in System Properties → Advanced → Startup and Recovery.

To read them:

  • BlueScreenView (NirSoft) lists crashes and the driver involved, which is easy for most people.
  • WinDbg (free, from the Microsoft Store): open the dump and run !analyze -v.

Common stop codes:

Stop code Usually points to
DRIVER_IRQL_NOT_LESS_OR_EQUAL, SYSTEM_SERVICE_EXCEPTION A faulty or outdated driver (graphics, network, antivirus)
MEMORY_MANAGEMENT, PAGE_FAULT_IN_NONPAGED_AREA RAM or a driver
CRITICAL_PROCESS_DIED, INACCESSIBLE_BOOT_DEVICE Disk or corrupted system files, see SFC and DISM
WHEA_UNCORRECTABLE_ERROR Hardware: CPU, RAM, overheating, overclock, power
CLOCK_WATCHDOG_TIMEOUT CPU or BIOS/firmware issue

Event 41 with BugcheckCode 0: no blue screen at all

If Event 41 shows BugcheckCode 0 and there is no Event 1001, Windows never got the chance to log a crash. That usually means:

  • Power loss: failing PSU, bad power strip, loose cable, or a laptop battery problem.
  • Overheating: the machine cut power to protect itself. Check fans, dust and temperatures (HWiNFO is good).
  • A hard freeze followed by holding the power button.
  • Hardware fault: RAM or motherboard.

Next steps by suspect

mdsched.exe                       # Windows Memory Diagnostic (reboots and tests RAM)
sfc /scannow                      # system files
Get-PhysicalDisk | Select FriendlyName, HealthStatus   # disk health
  • Drivers: update the graphics and chipset drivers from the manufacturer's site. If crashes began after an update, roll that driver back.
  • Heat: clean the machine and watch temperatures under load.
  • RAM: test with mdsched or MemTest86, and test one stick at a time.
  • Overclock/XMP: turn it off in the BIOS to see if the crashes stop.

If it keeps happening, note the stop code and the faulting driver or module, and search for that exact string. It narrows the cause far more than "my PC keeps restarting".

bsodevent-viewerpowershellwindows