Detecting Unplanned Shutdown

If Windows crashes or is otherwise stopped unexpectedly, when it restarts the next time, it logs a kernel error with ID 41. If you’d like to check in retrospect whether your Windows box did not shutdown regularly, try this:

Get-EventLog -Logname System -Source "Microsoft-Windows-Kernel-Power" | 
Where-Object EventID -eq 41 | 
Select-Object Index,TimeWritten,Source,EventID

A more modern and PowerShell 7-compatible way uses Get-WinEvent instead that uses a filter hash table:

Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    ProviderName = 'Microsoft-Windows-Kernel-Power'
    Id = 41
}

ReTweet this Tip!