How to Find the Shutdown Log in Windows 10

If you are curious to know why your computer shut down and what happened exactly during the shut down, you will be happy to know that Windows is able to track the shut down process and write a number of events in the system log. In this article, we will see how to find them.

As the OS is using the default log format, all the events related to the shut down can be viewed with the built-in Event Viewer tool. No other third-party tools are required.

In Windows 10, there are three events connected with shut down and restart.

Event ID 1074 - Indicates that the shut down process was initiated by an app. For example, it can be Windows Update.

Event ID 6006 - The clean shut down event. This means Windows 10 was turned off correctly.

Event ID 6008 - Indicates a dirty/improper shutdown. Appears in the log when the previous shutdown was unexpected, e.g. due to power loss or BSoD (Bug check).

Here is how to find these events.

To find the Shutdown log in Windows 10, do the following.

1. Press the Win + R keys together on the keyboard to open the Run dialog, type eventvwr.msc, and press the Enter key.
2. In Event Viewer, select Windows Logs -> System on the left.
3. On the right, click on the link Filter Current Log.
4. In the next dialog, type the line 1074, 6006, 6008 into the text box under Includes/Excludes Event IDs.
5. Click OK to filter the event log.

Now, the Event Viewer will display only events related to shut down.

Note: Starting with Windows 10 Fall Creators Update, the operating system is able to automatically reopen apps which were running before shutdown or restart. This behavior is totally unexpected for most Windows users who upgraded to the recent release of the OS. To avoid this issue, you can add a special "Shut Down" context menu to the Desktop that restores the classic behavior.

See the following article:

Add Shutdown Context Menu in Windows 10

That's it.