Solution
If your computer shuts down unexpectedly, Windows logs Event ID 41 the next time that the computer starts. The event text resembles the following information:
Event ID: 41
Description: The system has rebooted without cleanly shutting down first.
This event indicates that some unexpected activity prevented Windows from shutting down correctly. Such a shutdown might be caused by an interruption in the power supply or by a Stop error. If feasible, Windows records any error codes as it shuts down. During the kernel phase of the next Windows startup, Windows checks for these codes and includes any existing codes in the event data of Event ID 41.
By itself, Event ID 41 might not contain sufficient information to explicitly define what occurred. Typically, you also have to consider what was occurring at the time of the unexpected shutdown (for example, the power supply failed). Use the information in this article to identify a troubleshooting approach that is appropriate for your circumstances:
- Scenario 1: The computer restarts because of a Stop error, and Event ID 41 contains a Stop error (bug check) code
- Scenario 2: The computer restarts because you pressed and held the power button
- Scenario 3: The computer is unresponsive or randomly restarts and Event ID 41 isn't logged or the Event ID 41 entry lists error code values of zero
Scenario 1: The computer restarts because of a Stop error, and Event ID 41 contains a Stop error (bug check) code
When a computer shuts down or restarts because of a Stop error, Windows includes the Stop error data in Event ID 41 as part of more event data. This information includes the Stop error code (also called a bug check code), as shown in the following example:
EventData
BugcheckCode 159
BugcheckParameter1 0x3
BugcheckParameter2 0xfffffa80029c5060
BugcheckParameter3 0xfffff8000403d518
BugcheckParameter4 0xfffffa800208c010
Scenario 2: The computer restarts because you pressed and held the power button
Because this method of restarting the computer interferes with the Windows shutdown operation, we recommend that you use this method only if you've no alternative. For example, you might have to use this approach if your computer isn't responding. When you restart the computer by pressing and holding the power button, the computer logs an Event ID 41 that includes a non-zero value for the PowerButtonTimestamp entry.
<EventData>
<Data Name="BugcheckCode">0</Data>
<Data Name="BugcheckParameter1">0x0</Data>
<Data Name="BugcheckParameter2">0x0</Data>
<Data Name="BugcheckParameter3">0x0</Data>
<Data Name="BugcheckParameter4">0x0</Data>
<Data Name="SleepInProgress">0</Data>
<Data Name="PowerButtonTimestamp">131728546170882432</Data>
<Data Name="BootAppStatus">0</Data>
</EventData>
Scenario 3: The computer is unresponsive or randomly restarts and Event ID 41 isn't recorded or the Event ID 41 entry or lists error code values of zero.
This scenario includes the following circumstances:
-
You shut off power to an unresponsive computer, and then you restart the computer.
To verify that a computer is unresponsive, press the Caps lock key on the keyboard. If the Caps lock light on the keyboard doesn't change when you press the Caps lock key, the computer might be unresponsive (also known as a hard hang).
-
The computer restarts, but it doesn't generate Event ID 41.
- The computer restarts and generates Event ID 41, but the BugcheckCode and PowerButtonTimestamp values are zero.
In such cases, something prevents Windows from generating error codes or from writing error codes to disk. Something might block write access to the disk (as in the case of an unresponsive computer) or the computer might shut down too quickly to write the error codes or even detect an error.