14
6
I am using Windows 7. For some reason my PC just shut down and restarted itself. I did not receive any warnings or indication of this. Is there a way to find out why my PC just restarted?
Vader
Posted 2014-06-10T22:17:45.693
Reputation: 1 250
Find out why PC just restarted for no reason
Answers
17
These are the Event ID's I found helpful in tracking down a Reboot:
Event ID 1074 (Source: USER32) is "...has initiated the restart..."
Event ID 6005 (Source: EventLog) is "Event Log Service was Started".
Event ID 6006 (Source: EventLog) is "Event Log Service was Stopped".
Event ID 7001 (Source: WinLogon) is "User Logon".
Event ID 7002 (Source: WinLogon) is "User Logoff".
6005 is a good indicator the computer is Booting/Powering Up.
6006 is a good indicator the computer is Rebooting/Shutting Down.
1074 is what I see when something has triggered a reboot of my system (usually a windows update).
Example:
The process C:\Windows\CCM\CcmExec.exe (SomeComputerName) has initiated the restart of computer SomeComputerName on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
Reason Code: 0x80020001
Shutdown Type: restart
Comment: Your computer will restart at 01/07/2017 08:14:38 PM to complete the installation of applications and software updates.
Online the description for 1074 reads:
This event is written when an application causes the system to restart, or when the user initiates a restart or shutdown by clicking Start or pressing CTRL+ALT+DELETE, and then clicking Shut Down.
My log has a bunch of Informational Event ID's for 7036, so I chose to ignore those (as noise).
For the "Filter Current Log..." I punched this in to Include/Exclude the following:
-7036,1074,6005,6006,7001,7002
On my machine, I saw this:
A reboot notice went out at 6:14pm (while I was away at dinner).
The machine logged me out at 8:15pm.
The machine powered down at 8:16pm.
The machine powered up at 8:17pm (which is indicative of a Warm Reboot).
When I returned home from dinner and a movie, I logged back in at 8:59pm.
This is how I knew our IT had set up a policy that was only giving me a 2-hour notice for a reboot.
Your reasons for a reboot may be different, so jot down these times and look for anything logged around those times.
MikeTeeVee
Posted 2014-06-10T22:17:45.693
Reputation: 484
Thanks, it was Windows 10 auto update in my case... – Mike – 2018-10-18T08:18:57.580
1
Nirsoft's free tool, TurnedOnTimesView, displays reasons.
philu
Posted 2014-06-10T22:17:45.693
Reputation: 140
0
The answer from MikeTeeVee is already a good starting place, however you also might want to include some of the Kernel-Power and Kernel-General events (12,13,89,109,41,42).
These are respectively: operating system start, operating system shutdown, power manager shutdown, reboot without clean shutdown, idle system entering sleep, sleep operation failed. These certainly have some overlap with the Event IDs already provided, but these may add additional context if needed.
The combined Include/Exclude Event IDs field:
-7036,1074,6005,6006,7001,7002,6008,12,13,109,41,42,43,1
Stephen Klancher
Posted 2014-06-10T22:17:45.693
Reputation: 142
-1
Check event viewer. Open up your start menu on the task bar, and type in "Event Viewer" (without the quotes) in the box that says "search programs and files" and press enter. When you have event viewer open, on the left side click the arrow by "Windows Logs". You will most likely find your reboot in "System".
AryaW
Posted 2014-06-10T22:17:45.693
Reputation: 27
Right click 'My Computer' and select manage. The event Viewer will give you a way to look at the event, error, system, and other logs. – cliff2310 – 2014-06-10T22:23:10.047
2where is 'My Computer' – Vader – 2014-06-10T22:30:32.597
Disable the option to automatically restart upon system failure in the Startup and Recovery options. Then wait to see if a BSOD occurs. – joeqwerty – 2014-06-10T22:56:29.537
To open the Event Viewer you can press Win+R, type
– and31415 – 2014-06-10T22:58:54.930eventvwr.mscin the text box, and then press Enter.@and31415 I get an error http://i.imgur.com/z0ua3Iw.png
– Vader – 2014-06-10T23:01:14.383Have you got any restore points? – and31415 – 2014-06-10T23:02:53.603
@vader 'My Computer' is the icon on the desktop that opens the file explorer. Also under the Windows icon in the taskbar 'computer'. again right click it. – cliff2310 – 2014-06-10T23:07:01.523
@and31415 nope, it is turned off – Vader – 2014-06-10T23:20:55.850
Open a command prompt as administrator, and run this command:
sfc /scannow– and31415 – 2014-06-10T23:22:05.143@and31415
`Beginning system scan. This process will take some time.
Beginning verification phase of system scan. Verification 100% complete.
Windows Resource Protection found corrupt files and successfully repaired them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log
The system file repair changes will take effect after the next reboot.` – Vader – 2014-06-10T23:43:52.847
@Vader Restart Windows, and run the command again. Then report back. – and31415 – 2014-06-10T23:44:34.393
@and31415 Windows Resource Protection did not find any integrity violations. – Vader – 2014-06-11T00:04:15.293
Let us continue this discussion in chat.
– and31415 – 2014-06-11T00:05:46.107@and31415 I am in the chat room – Vader – 2014-06-11T00:08:37.237