How To Check If Windows 10 Shut Down Normally

Windows 10 can crash. In fact, in its early days, it did that a lot. A crash is not a normal shut down event. It’s a forced shut down initiated by the system. Users too can force Windows 10 to shut down without using the power menu. All you have to do is press and hold down the power button on your laptop or desktop until the system shuts down. You shouldn’t force your system to shut down unless there is absolutely no alternative. If you suspect that your system crashed, or that someone forced it to shut down, you can check. The events log lets you check if Windows 10 shut down normally or not. All you need to know is the correct event ID to look for.

Windows 10 Shut Down Event IDs

To view Windows 10 shut down events, open the run box via the Win+R keyboard shortcut and type the following;

eventvwr.msc

Tap the Enter key to open Event Viewer.

In the left column expand Windows logs>System. Look at the column on the right and you will find an option to filter the current log. Click ‘Filter Current Log…’.

In the Filter Current Log, click inside the <All Event IDs> box. This is where you will enter an event ID to view all logged events that correspond to it.

Event ID

With respect to system shut down, forced shut down, system crash, and a system restart the following are the Event IDs you need to filter for;

Forced Shut Down: Event ID 6008

Normal Shut Down: Event ID 6006

System Crash/BSOD: Event ID 1001

System Turned On: Event ID 6005

There’s no way to tell when a system was restarted however, you can filter for event IDs 6006 and 6005 and compare the time stamp on each one.

Event ID Information

The information describing any of the events listed above isn’t going to tell you in simple terms that your system was shut down or it crashed. If that’s what you’re looking for, the event being logged is your answer. In all cases, the event will have a date and time stamp.

The following shows the event information for system start up. The description simply says the event service was started. This is the service that logs all events on Windows and it starts with, and stops with Windows.

The events will not differentiate between how a system was shut down i.e. via the power menu or via the Command Prompt, or by an app. It also can’t differentiate between how a system was forced to shut down i.e. was the power button held down or was a system unplugged.

Read Full Bio

Fatima Wahab

Fatima has been writing for AddictiveTips for six years. She began as a junior writer and has been working as the Editor in Chief since 2014. Fatima gets an adrenaline rush from figuring out how technology works, and how to manipulate it. A well-designed app, something that solves a common everyday problem and looks

Latest from Author

How to Take a Screenshot on Windows Best FPS Counter Software for Windows