How To Check If Windows 10 Shut Down Normally

There are few computer mysteries more dramatic than pressing the power button in the morning and wondering, “Did my Windows 10 PC shut down normally last night, or did it throw a tiny digital tantrum after I walked away?” Maybe your laptop battery drained overnight. Maybe Windows Update restarted the system. Maybe the cat stepped on the power strip like a furry IT saboteur. The good news is that Windows 10 keeps a surprisingly detailed diary of what happened.

If you know where to look, you can check whether Windows 10 shut down normally, identify unexpected shutdowns, see who or what triggered a restart, and spot patterns that might point to power issues, driver crashes, overheating, update restarts, or Fast Startup confusion. This guide walks you through the clearest methods using Event Viewer, PowerShell, Command Prompt, Reliability Monitor, and practical troubleshooting steps.

The main keyword here is simple: how to check if Windows 10 shut down normally. But the bigger goal is even better: helping you read Windows shutdown logs like a calm, confident detective instead of someone staring at Event Viewer like it just opened a portal to another planet.

Why You Might Need To Check Windows 10 Shutdown History

Most of the time, a Windows 10 shutdown is boring. You click Start, choose Power, select Shut down, and the PC turns off. Beautiful. Peaceful. Almost suspiciously mature.

But when something goes wrong, checking the shutdown history becomes useful. You may need to know whether Windows closed cleanly before a crash, whether a power outage interrupted the system, whether an update caused a reboot, or whether the machine is waking, restarting, or shutting down while you are not around.

A normal shutdown means Windows had time to close user sessions, stop services, write system records, and power down in an orderly way. An abnormal shutdown means the system lost power, froze, crashed, restarted without warning, or was forced off before Windows finished its normal shutdown process.

The fastest place to verify this is Event Viewer, where Windows stores system events with specific Event IDs. Think of Event IDs as little numbered clues. Some say, “Everything closed properly.” Others say, “Something went sideways, please investigate.”

Method 1: Check Normal Shutdown Events In Event Viewer

Event Viewer is the built-in Windows tool that records system, application, security, and hardware-related events. It is not glamorous, but it is extremely useful. If Windows 10 shut down normally, the System log usually contains records that show an orderly shutdown sequence.

How To Open Event Viewer

Press Windows + R to open the Run box.
Type eventvwr.msc.
Press Enter.
In the left panel, expand Windows Logs.
Click System.

The System log may contain thousands of entries, so do not scroll manually unless you enjoy digital archaeology. Instead, filter the log.

Filter The System Log For Shutdown Events

Right-click System.
Select Filter Current Log.
In the All Event IDs box, enter:
12,13,41,1074,6005,6006,6008,6009
Click OK.

This filter shows the most useful startup and shutdown-related events. You are looking for the timeline around the time your computer turned off or restarted.

Important Windows 10 Shutdown Event IDs Explained

Event IDs are the heart of checking whether Windows 10 shut down normally. Here are the key ones you should understand.

Event ID 1074: A Planned Shutdown Or Restart

Event ID 1074 usually means a user, program, service, or system process initiated a shutdown or restart. This is one of the strongest signs that the shutdown was planned rather than sudden.

For example, the event message may say that explorer.exe, winlogon.exe, or another process initiated the shutdown on behalf of a user. It may also show a reason such as operating system update, planned restart, power off, or application maintenance.

If you see Event ID 1074 shortly before the computer shut down, that is usually a good sign. It means Windows knew the shutdown was coming. In plain English: Windows did not fall down the stairs; someone told it to leave the building.

Event ID 6006: Event Log Service Stopped

Event ID 6006 means the Event Log service stopped. This commonly appears during a proper shutdown because Windows is stopping services in an orderly sequence.

If you see Event ID 6006 near the shutdown time, it often indicates that Windows had enough time to close down normally. It is one of the classic signs of a clean shutdown.

Event ID 6005: Event Log Service Started

Event ID 6005 means the Event Log service started. This appears when Windows boots up. It does not prove the previous shutdown was clean by itself, but it helps you match shutdown and startup times.

For example, if you see Event ID 6006 at 10:30 PM and Event ID 6005 at 8:05 AM the next morning, the system probably shut down normally at night and started normally in the morning.

Event ID 13: The Operating System Is Shutting Down

Kernel-General Event ID 13 states that the operating system is shutting down at a specific system time. This is another useful clean-shutdown marker. It tells you Windows began the shutdown process in an organized way.

Event ID 12: The Operating System Started

Kernel-General Event ID 12 records when the operating system started. Pairing Event ID 12 with Event ID 13 gives you a clearer boot-and-shutdown timeline.

Event ID 6008: The Previous Shutdown Was Unexpected

Event ID 6008 is the event nobody wants to see when checking for a normal shutdown. It means Windows detected that the previous shutdown was unexpected.

This can happen after a power outage, forced power-button shutdown, system freeze, hardware failure, overheating, blue screen crash, or sudden restart. If Event ID 6008 appears after your PC turns back on, Windows is basically saying, “I do not know what happened, but that was not a graceful exit.”

Event ID 41: Kernel-Power Warning

Kernel-Power Event ID 41 appears when Windows restarts without first shutting down cleanly. It does not always identify the exact cause, but it confirms that the system lost its normal shutdown path.

Common causes include power loss, a crash, a frozen system, a failing power supply, unstable drivers, overheating, or someone holding the power button until the machine gives up. Event ID 41 is not the villain itself; it is the chalk outline at the scene.

How To Tell If Windows 10 Shut Down Normally

To decide whether Windows 10 shut down normally, look at the sequence of events around the shutdown time.

Signs Of A Normal Shutdown

You see Event ID 1074 showing a planned shutdown or restart.
You see Event ID 13 showing the operating system began shutting down.
You see Event ID 6006 showing the Event Log service stopped.
The next startup shows Event ID 6005 or Event ID 12.
You do not see Event ID 6008 or Event ID 41 related to that shutdown.

Signs Of An Abnormal Shutdown

You see Event ID 6008 after startup.
You see Kernel-Power Event ID 41.
There is no clean Event ID 6006 before the system stopped.
The PC restarted without user action.
The system froze, crashed, lost power, or showed a blue screen.

A clean shutdown usually has a tidy paper trail. An unexpected shutdown often has gaps, warnings, or error records. Event Viewer is useful because computers are terrible liars. They may crash dramatically, but they usually leave paperwork.

Method 2: Use PowerShell To Check Shutdown Logs Quickly

If you prefer a faster method, PowerShell can show shutdown events without clicking through Event Viewer. This is especially helpful if you troubleshoot computers often or want a quick list of recent shutdown-related records.

Right-click the Start button and choose Windows PowerShell or Windows PowerShell (Admin). Then run:

This command checks the System log for the most important startup and shutdown Event IDs. The output includes the event time, Event ID, provider, and message.

How To Read The PowerShell Output

If you see 1074, 13, and 6006 before shutdown, the system likely shut down normally. If the next startup includes 6008 or 41, the previous shutdown was probably unexpected.

PowerShell is not required for beginners, but it is wonderfully efficient. Once you get used to it, Event Viewer starts to feel like walking to the mailbox when you own a drone.

Method 3: Use Command Prompt With Wevtutil

Windows also includes wevtutil, a command-line tool for querying event logs. Open Command Prompt as Administrator and run:

This command returns recent matching System events in text format. The /c:30 part limits results to 30 events, and /rd:true reads in reverse direction so newer records appear first.

This method is useful when Event Viewer is slow, when you are working remotely, or when you simply enjoy making Windows answer questions from a black box like a movie hacker. No hoodie required.

Method 4: Check Reliability Monitor For Shutdown Problems

Reliability Monitor gives you a more visual way to spot shutdown crashes and system failures. It is easier to read than Event Viewer and is great for casual troubleshooting.

How To Open Reliability Monitor

Press Windows + R.
Type perfmon /rel.
Press Enter.

Reliability Monitor shows a timeline of system stability. Look for red X marks around the date and time of the suspected shutdown. You may see entries such as “Windows was not properly shut down,” application failures, hardware errors, or Windows failures.

This tool is excellent when you want the big picture. Event Viewer gives you the detailed police report. Reliability Monitor gives you the crime board with strings attached, minus the dramatic lighting.

Do Not Confuse Shut Down With Restart In Windows 10

Windows 10 includes a feature called Fast Startup, which can make shutdown behavior slightly confusing. With Fast Startup enabled, Windows may use a hybrid shutdown process. It logs off users, saves part of the system state, and starts faster next time.

This means a normal “Shut down” may not behave exactly like a full cold shutdown. If you are troubleshooting drivers, updates, hardware detection, or strange startup behavior, a Restart is often more complete than Shut down followed by powering on again.

How To Force A Fuller Shutdown

To bypass Fast Startup once, hold Shift while clicking Shut down. You can also restart the computer instead of shutting it down when testing whether a problem clears after a full system reload.

To disable Fast Startup:

Open Control Panel.
Go to Hardware and Sound.
Select Power Options.
Click Choose what the power buttons do.
Click Change settings that are currently unavailable.
Uncheck Turn on fast startup.
Click Save changes.

Fast Startup is not bad. It is like a shortcut through the neighborhood. Most days, it saves time. But if you are troubleshooting, sometimes you want the main road with streetlights, signs, and fewer surprises.

Common Reasons Windows 10 Does Not Shut Down Normally

If Event Viewer shows abnormal shutdown events, the next step is finding the cause. Here are common suspects.

Power Loss Or Forced Shutdown

A loose power cable, drained laptop battery, failing UPS, bad power strip, or someone holding the power button can cause Event ID 41 or 6008. For desktops, check the wall outlet, surge protector, and power supply. For laptops, check the battery health and charger connection.

Windows Update Restarted The PC

Event ID 1074 may show that a Windows process initiated a restart for updates. This is usually normal, although it can be annoying if it happens during work. Check Windows Update history if the timing matches an update installation.

Driver Or Hardware Crash

Graphics drivers, storage drivers, network drivers, overheating components, faulty RAM, and unstable power supplies can cause sudden restarts. If shutdown problems happen during gaming, video rendering, or heavy workloads, hardware stress may be involved.

Blue Screen Or System Failure

If the PC crashes before shutting down, look for bugcheck-related events and dump files. Reliability Monitor may show “Windows stopped working” or “Windows was not properly shut down.” Event Viewer may also show system errors before the Kernel-Power event.

Fast Startup Or Hybrid Shutdown Issues

If the system seems to shut down but behaves strangely on the next boot, Fast Startup may be involved. Try disabling it temporarily and compare the shutdown logs for several days.

Simple Troubleshooting Checklist

Once you know the shutdown was not normal, use this checklist:

Save your work and perform a full restart.
Check Event Viewer for IDs 41, 6008, 1074, 6006, 13, and 12.
Open Reliability Monitor and review the same date.
Check Windows Update history.
Update graphics, chipset, storage, and network drivers from trusted sources.
Disable Fast Startup temporarily.
Check power cables, laptop battery, charger, and surge protector.
Run sfc /scannow from an elevated Command Prompt to check system files.
Run chkdsk if storage errors appear.
Watch for patterns: same time, same app, same game, same workload, same update.

The pattern matters. One unexpected shutdown after a storm may be boring. Five unexpected shutdowns during gaming may be a heat, power, or driver problem. Ten shutdowns every night at 3:00 AM might point toward scheduled updates, maintenance tasks, or power settings.

Example: Reading A Realistic Shutdown Timeline

Imagine your Windows 10 PC was off when you came back in the morning. You open Event Viewer and filter the System log.

You see this sequence:

10:14 PM Event ID 1074: User initiated power off.
10:14 PM Event ID 13: Operating system is shutting down.
10:15 PM Event ID 6006: Event Log service stopped.
8:02 AM Event ID 12: Operating system started.
8:02 AM Event ID 6005: Event Log service started.

That looks normal. Windows was told to shut down, it began shutting down, stopped the Event Log service, and started normally the next morning.

Now imagine this sequence:

1:37 AM No shutdown record.
7:50 AM Event ID 41: System rebooted without cleanly shutting down first.
7:50 AM Event ID 6008: Previous shutdown was unexpected.
7:51 AM Event ID 6005: Event Log service started.

That does not look normal. Windows did not record a proper shutdown. The system likely lost power, crashed, froze, or was forced off.

Real-World Experiences: What Checking Windows 10 Shutdown Logs Feels Like

In real life, checking whether Windows 10 shut down normally is rarely about one perfect clue. It is usually about building a small story from several boring-looking records. The first time many users open Event Viewer, they panic because it contains warnings and errors even on healthy computers. That is normal. Event Viewer is not a happiness journal; it records everything from tiny service complaints to serious crashes. The trick is to focus on the exact time of the shutdown and ignore unrelated noise.

One common experience is the “I definitely shut it down” situation. A user clicks Shut down at night, but in the morning the PC seems to have restarted. Event Viewer shows Event ID 1074 from a Windows process, followed by startup events a few minutes later. In that case, the culprit is often Windows Update or a scheduled restart. It feels mysterious because nobody was sitting at the keyboard, but the log usually shows that Windows had a reason. Annoying? Yes. Supernatural? Sadly, no.

Another common case is the desktop that randomly powers off under load. The user may suspect Windows, but the logs show Kernel-Power Event ID 41 and Event ID 6008 without a clean shutdown event beforehand. If this happens while gaming, editing video, or running heavy software, the issue may involve overheating, a weak power supply, unstable drivers, or failing hardware. Windows is not always the criminal. Sometimes it is just the witness who woke up after the lights went out.

Laptop users often discover battery-related patterns. For example, the laptop appears to shut down overnight, but Event Viewer shows an unexpected shutdown after the battery drained completely. This can happen when sleep mode fails, the lid-close action is misconfigured, or the battery is aging. Checking the timestamp helps. If the unexpected shutdown happened hours after the user stopped working, the laptop may have slept first, then lost power later.

Fast Startup creates another funny troubleshooting moment. A user shuts down repeatedly, expecting a fresh start, but the same weird issue returns every morning. Then they click Restart once, and the problem disappears. That is because Restart reloads Windows more completely than a Fast Startup shutdown. In practice, many technicians try Restart before deep troubleshooting because it clears more system state. It is the computer equivalent of not just taking a nap, but actually leaving the room and coming back with a better attitude.

The best habit is to check logs for three things: the shutdown event, the startup event, and any warning between them. A normal shutdown has an orderly chain. An abnormal shutdown has a messy gap. Once you learn the difference, Event Viewer becomes less intimidating. It stops being a wall of technical confetti and starts acting like a timeline. You may not solve every shutdown mystery in five minutes, but you will know whether Windows 10 shut down normally, whether it crashed, and where to look next.

Conclusion

To check if Windows 10 shut down normally, open Event Viewer, go to Windows Logs > System, and filter for shutdown-related Event IDs such as 1074, 6006, 6005, 13, 12, 41, and 6008. A normal shutdown usually includes planned shutdown and service-stop records. An abnormal shutdown often shows Kernel-Power Event ID 41 or Event ID 6008 after the next startup.

For faster checking, use PowerShell or wevtutil. For a friendlier visual summary, use Reliability Monitor. If abnormal shutdowns happen repeatedly, investigate power, updates, drivers, overheating, battery health, Fast Startup, and hardware stability.

Note: This article is based on real Windows 10 system logging behavior, standard Event Viewer usage, Windows shutdown Event IDs, PowerShell event log querying, and practical troubleshooting patterns used by Windows users and technicians.