How to find why Windows restarted
If a Windows VPS or dedicated server restarted unexpectedly, start with Event Viewer. The steps below only read system logs and do not change server settings.
Step 1: Open Event Viewer
Press Win + X and select Event Viewer, or search for Event Viewer from the Start menu.
Step 2: Open the System log
Go to Windows Logs → System. Sort by date and time, then locate the period immediately before and after the restart.
Step 3: Filter the useful event IDs
Use Filter Current Log and check events such as 41, 6008, 1074, 1001, 46, 129, 153, 18 and 19.
Step 4: Read events as a timeline
Do not diagnose the problem from Event 41 or 6008 alone. Compare the source, full message and events from 5–10 minutes before the restart. A BugCheck event or a storage timeout can be more useful than the final restart marker.
Quick access
You can also run the read-only PowerShell command in the reference below to collect the relevant entries for support.
QUICK REFERENCE
Common Windows restart and shutdown events
Use the event ID together with its source, time, message and nearby events. One event by itself rarely proves the root cause.
41Kernel-PowerUnexpected restartCritical
Windows detected that the previous shutdown was not clean. Causes can include a bug check, a hard hang, abrupt power loss, a forced reset or a hypervisor reset.
Check: BugcheckCode, PowerButtonTimestamp and nearby events 1001 and 46.
6008EventLogPrevious shutdown was unexpectedWarning
Confirms the time of an unexpected shutdown. It is a consequence marker rather than a diagnosis.
Check: System and Application logs 5–10 minutes before the recorded time.
1074User32Planned restart or shutdownNormal
A user, service or program requested the restart. The event message usually identifies the process, account and reason.
Check: process name such as shutdown.exe, svchost.exe or an update installer.
1001BugCheckBlue-screen restartCritical
Windows restarted after a stop error. The message contains the stop code and often the memory-dump path.
Check: C:\Windows\Minidump and the exact bug-check code.
46volmgrCrash dump initialization failedWarning
Windows could not prepare or write a crash dump, so the useful bug-check data might be missing.
Check: pagefile and Startup and Recovery dump settings.
18 / 19WHEA-LoggerHardware error reportedHardware
WHEA recorded a hardware error. Read the component, error source and processor/APIC information in the event details.
Check: CPU, RAM, PCIe/GPU, firmware and host hardware. On a VPS, include the event in a support request.
129 / 153Storport / DiskStorage timeout or retried I/OStorage
Windows waited too long for the storage subsystem or had to retry an I/O operation. Repeated events can precede freezes and restarts.
Check: disk latency, storage drivers, free space and whether the event repeats under load.
6005 / 6006 / 6009EventLogStartup and clean-shutdown timelineInfo
6005 means the Event Log service started, 6006 means it stopped cleanly, and 6009 records Windows version information during startup.
Use: build a timeline and distinguish a normal reboot from an abrupt one.
How to read the combination of events
| What you see | Likely interpretation | Next step |
|---|---|---|
1074 → 13 → 6009 | Normal, requested restart | Read the process and account in Event 1074. |
1001 + 41 + 6008 | Blue-screen restart | Save the stop code and minidump. |
41 + 6008, no 1001 | Hard hang, abrupt reset or dump not written | Check Event 46, storage and the events before the restart. |
129 / 153 before restart | Storage timeout or overload may be involved | Check disk latency and repeat frequency. |
WHEA 18 / 19 before restart | Hardware-reported fault | Save event XML and contact support if this is a VPS. |
Show only relevant events in PowerShell
Run PowerShell as administrator. The command reads the log only and does not change server settings.
Get-WinEvent -FilterHashtable @{
LogName = 'System'
Id = 13,18,19,41,46,1001,1074,6005,6006,6008,6009,129,153
} -MaxEvents 100 |
Select-Object TimeCreated, Id, ProviderName, LevelDisplayName, Message |
Format-ListWhat to send to support
- Exact restart time and time zone.
- Event ID, source and full message.
- Events from 5–10 minutes before the restart.
- Bug-check code and minidump, when available.
- What was running and whether CPU, RAM or disk was under load.