How to fix Event ID 6008 "The previous system shutdown was unexpected" in Windows?

Event ID 6008 from the source EventLog says "The previous system shutdown was unexpected". It is a record of the symptom: Windows went off without a clean shutdown, and the event does not say why. The cause is in the events logged around it, so list those first and fix what they point to.

Facts checked on 13 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2, with notes for Windows Server.

What Event ID 6008 means and why it is not the cause

Event ID 6008 is an entry in the System log from the source EventLog, with the level Error. Its full text is "The previous system shutdown at [time] on [date] was unexpected." Microsoft describes it as the record of an improper or dirty shutdown, logged when the most recent shutdown was unexpected.

Windows writes it at the next start. During a clean shutdown Windows closes files, tells services and apps to stop and notes that it ended properly. When the PC goes off without those steps, the next start finds no such note and logs 6008.

• Two times in one event. The time in the text is when Windows was last known to be running. The Date and Time column is when the event was written, which is the next start.
• Other spellings. Event 6008, EventID 6008, Event Log 6008, error 6008 and error code 6008 all mean this one entry. It is an event number, not a Windows error code.
• Dirty shutdown. Microsoft uses this name for any shutdown that skips the normal process, such as a power cut or a held power button.
• The registry trace. Windows keeps the values DirtyShutdown, LastAliveStamp and TimeStampInterval under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability. We could not confirm from Microsoft how often the time stamp is refreshed, so treat the time in the text as approximate.

The events around 6008 and what each one tells you

Microsoft's guide to unexpected restarts reads 6008 together with a fixed set of neighbours. A normal restart shows event 1074, then 13, then 6009. An unexpected one shows 41 and 6008, usually without any 1074 before it.

Event numbers repeat across sources. Microsoft warns that an ID can belong to several sources, so always read the Source column too. In our test, IDs 12 and 19 also came from Microsoft-Windows-Wininit with unrelated messages. An event 1001 from another source is not a crash record.

Why the previous system shutdown was unexpected: the causes

Microsoft names two main reasons for a shutdown that is not clean: an interruption in the power supply and a stop error. It adds that unexpected shutdowns are mostly caused by components outside the operating system. We have no numbers on how often each cause occurs, so the table is ordered by how clearly the log shows each one.

How to find and fix the cause of Event ID 6008

Fixes 1 and 2 are the diagnosis and take about ten minutes: they tell you which of the later fixes is yours. Fixes 3 to 8 each repair one cause. Fix 9 is for Windows Server and virtual machines. Do not work through all of them in order.

Fix 1. List the shutdown events together with one command

5 minutesNo riskEveryone who found event 6008 and wants to know what happened before it.

Event 6008 only makes sense next to its neighbours. One filter puts every start, clean shutdown, crash record and requested restart of the last two weeks in one list, in the order they happened.

1. Right-click Start and select Terminal (Admin). On Windows 10, type PowerShell in the search box, right-click Windows PowerShell and select Run as administrator.
2. Select Yes when Windows asks for permission.
3. Paste the command below and press Enter.
4. Find the row with ID 6008 and read the time inside its text. That is when the PC went off.
5. Read the rows above it. They show what Windows logged before that time: a 1074, a 13, or nothing at all.
6. Read the rows with the same start time as 6008: an event 41, and after a crash an event 1001.
7. Ignore rows whose ProviderName is Microsoft-Windows-Wininit. It also uses ID 12, for a message about LSASS.exe that has nothing to do with a shutdown.

PowerShell (as administrator): the shutdown history of the last 14 days, oldest first

Get-WinEvent -FilterHashtable @{ LogName='System'; Id=12,13,41,46,86,1001,1074,6005,6006,6008,6009,6013; StartTime=(Get-Date).AddDays(-14) } |
  Sort-Object TimeCreated |
  Format-Table TimeCreated, Id, ProviderName, Message -Wrap

Microsoft's own list for a restart history also has IDs 19 and 7045. We left them out here, because in our test their rows outnumbered the shutdown rows: 7045 lists every installed service. Fix 3 uses them where they help. Change -14 to look further back, and run the command as administrator, or it can show errors about logs it may not read.

1. Prefer Event Viewer? Press Win + R, type eventvwr and select OK.
2. Expand Windows Logs and select System.
3. Select Filter Current Log in the right pane.
4. In the event ID box, type 12,13,41,46,86,1001,1074,6005,6006,6008,6009,6013 and select OK.

Fix 2. Read the details of event 41 to tell a crash from a power loss

5 minutesNo riskYour list from Fix 1 shows a Kernel-Power event 41 at the same start as event 6008.

If Windows can, it records error codes while it goes down and puts them into event 41 at the next start. Three values in its details separate a crash, a held power button and a plain loss of power.

1. Open Event Viewer (Win + R, eventvwr) and go to Windows Logs > System.
2. Double-click the Kernel-Power event with ID 41 that has the same date and time as your event 6008.
3. Open the Details tab.
4. Read BugcheckCode, PowerButtonTimestamp and SleepInProgress under EventData.
5. Compare the values with the table below.

• The code is decimal. Stop codes are documented in hexadecimal. Open Calculator, switch it to Programmer mode, enter the number with DEC selected and read the HEX line. Microsoft's example: 159 becomes 0x0000009F.
• Eight digits. Fill the hex value with zeros in front until eight digits follow the 0x, because that is how Microsoft's reference lists the codes.
• SleepInProgress. Microsoft's article shows this value but does not explain it. We could not confirm what a value other than 0 means for the diagnosis.

Fix 3. After a crash: find the stop code and undo the change that came before it

20 minutesLow riskEvent 41 holds a bug check code, or an event 1001 says the computer has rebooted from a bugcheck.

Here the unexpected shutdown was a Windows crash. Microsoft's method is to find the first crash in the history and look at what was installed shortly before it: a driver, an update or an application.

1. In the list from Fix 1, open the event 1001 from WER-SystemErrorReporting. Note the bug check code and the path after "A dump was saved in".
2. Look the code up in Microsoft's Bug Check Code Reference. The page of the code often names the kind of driver or hardware involved.
3. Scroll back to the first unexpected shutdown in the list and note its date.
4. Run the second command below. Read only the rows of the days just before that date: 7045 from Service Control Manager (a service or driver was installed) and 19 from Microsoft-Windows-WindowsUpdateClient (an update was installed).
5. If a driver arrived just before: right-click Start, open Device Manager, double-click the device, open the Driver tab and select Roll Back Driver.
6. If a Windows update arrived just before: open Settings > Windows Update > Update history > Uninstall updates and remove it.
7. Use the PC as usual and run the command from Fix 1 again after a few days.

PowerShell (as administrator): what was installed in the last 30 days

Get-WinEvent -FilterHashtable @{ LogName='System'; Id=19,7045; StartTime=(Get-Date).AddDays(-30) } |
  Sort-Object TimeCreated |
  Format-Table TimeCreated, Id, ProviderName, Message -Wrap

Every step of the driver rollback, also for Windows 10: Update, roll back or reinstall a driver Removing an update and pausing it so it does not come straight back: How to uninstall a Windows update

Fix 4. Make the next crash leave a stop code and a dump file

10 minutesLow riskYou saw a blue screen or suspect a crash, but event 41 shows only zeros, or the log has an event 46 from volmgr.

By default Windows restarts straight after a stop error, so the code is on screen for a moment only. Without a usable paging file it also cannot write a dump, and then event 41 stays empty.

1. Open Control Panel and select System and Security > System. On Windows 11 this opens Settings > System > About.
2. Select Advanced system settings and open the Advanced tab.
3. In the Startup and Recovery area, select Settings.
4. Under System failure, keep Write an event to the system log ticked and clear Automatically restart.
5. Under Write debugging information, choose Automatic memory dump. This is the Windows default.
6. Check that Dump file shows %SystemRoot%\MEMORY.DMP and select OK.
7. Make sure the paging file is on the Windows drive and set to System managed size.
8. Restart the PC.

Kernel and automatic dump

%SystemRoot%\MEMORY.DMP, normally C:\Windows\MEMORY.DMP. Overwritten by the next crash while Overwrite any existing file is ticked.

Small memory dumps

%SystemRoot%\Minidump. One new file for each crash. Needs a paging file of at least 2 MB on the boot volume.

Paging file

Must be on the boot volume. With System managed size and Automatic memory dump, Windows sizes it for a kernel dump by itself.

Free space

Microsoft's general advice for unexpected restarts is to keep 10% to 15% of the drive free.

Registry key behind the dialog

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl. The dialog is the safe way to change it.

Fix 5. Check the power when event 41 shows only zeros

15 to 30 minutesLow riskThe PC goes black at once with no blue screen, and event 41 has BugcheckCode 0 and PowerButtonTimestamp 0, or is missing.

When power is interrupted, Windows cannot write a code. Microsoft lists the cases for this pattern: a removed or drained battery, an unplugged PC or an outage, and a power supply that is underpowered or faulty.

1. Compare the time in the 6008 text with what else happened: lights that flickered, other devices that restarted, a tripped breaker.
2. Shut the PC down, then check that the power cable sits firmly at both ends. On a laptop, check the charger plug and the battery.
3. If you added hardware shortly before the shutdowns began, remove it again and test. Microsoft names this step first for unexpected restarts.
4. If you added memory, a newer processor, drives or external devices, check that the power supply has enough wattage for them.
5. If the PC is overclocked, set it back to its standard speed and test again.
6. On a laptop, run the battery report below and open the HTML file it creates.
7. Where outages are common, put the PC on an uninterruptible power supply (UPS).

Terminal: battery report, saved as an HTML file in the current folder

powercfg /batteryreport

• What the battery report is. Microsoft describes it as a report of battery usage characteristics over the lifetime of the system. A battery that drains far faster than it used to fits a laptop that dies without warning.
• What we could not confirm. Windows has no event that says "the power supply is failing". A weak supply is found by exclusion, or by testing with another one.

Fix 6. Look for a critical thermal event and deal with the heat

20 minutesLow riskThe PC goes off under heavy load such as games or rendering, or the System log holds a Kernel-Power event 86.

When a thermal zone reaches its critical temperature, the PC is shut down to protect the hardware. Windows records that as Kernel-Power event 86 after the shutdown, and the event names the thermal zone that caused it.

1. Open Event Viewer (Win + R, eventvwr) and go to Windows Logs > System.
2. Select Find in the right pane, type critical thermal event and select Find Next.
3. If an event 86 from Kernel-Power turns up, compare its time with your event 6008 and note the thermal zone it names.
4. Shut the PC down and unplug it.
5. Clear dust from the air vents and fans, and make sure nothing blocks the vents where the PC stands.
6. Start the PC and check that the fans turn.
7. Remove any overclock and test under the same load again.

• Event 125 is normal. Windows logs Kernel-Power event 125, an ACPI thermal zone being enumerated, at every start for every thermal zone. It is not a sign of overheating.
• No event 86 does not clear the PC. Microsoft's hardware documentation ties the event to firmware that defines a critical temperature for Windows. We could not confirm that every PC reports it.
• Reading temperatures. Microsoft says to examine the internal temperature of the hardware but names no Windows tool for it. Use the diagnostics or the firmware setup screen of your PC maker.

Fix 7. Test the memory

20 minutes or moreNo riskEvent 41 shows only zeros, or the stop codes differ from crash to crash, and power and heat are ruled out.

Microsoft's hardware checks for an event 41 without codes include the memory: test its health and check that every module runs at the same speed and is set up correctly. Faulty memory can stop a PC without leaving a record.

Press Win + R and run the Windows memory test

mdsched.exe

1. Choose when to test. Select Restart now and check for problems (recommended) to test right away. Select Check for problems the next time I start my computer if you want to finish your work first: the test then runs at the next start.
2. Let the test run. The PC restarts into a blue screen that shows the progress of the test. You do not have to do anything. When the test ends, the PC restarts by itself and Windows loads.
3. Look for the notification. Sign in. After a short while Windows shows a notification with the result, also when no errors were found. If you missed it, read the result in Event Viewer.
4. Open the System log. Press Windows + R, type eventvwr and select OK. In Event Viewer, expand Windows Logs and select System.
5. Find the result. Right-click System and select Find. Type MemoryDiagnostics-Results and press Enter. Select the event that is found: its text says whether the test detected errors.

These steps were written for Windows 11 25H2 and 26H2, Windows 10 22H2. The full page with the other versions and what each result means: How to test your RAM with Windows Memory Diagnostic

The whole procedure with its result messages: How to test your RAM with Windows Memory Diagnostic If you use a memory profile from the firmware setup to run the modules faster than their base speed, set it back to default for the test.

Fix 8. After a hang: find what froze before you forced the power off

20 minutesLow riskThe PC froze and you held the power button, so event 41 holds a PowerButtonTimestamp, or you pulled the plug.

Here the unexpected shutdown was your own hand, and the real problem is the hang before it. Reliability Monitor shows, day by day, which failures and installs came before the freeze, and a clean boot tells you whether background software causes it.

1. Press Win + R, type perfmon /rel and press Enter. Reliability Monitor opens.
2. Select the day of the event 6008 in the chart.
3. Read the entries of that day and of the days before it, critical ones first.
4. Select View technical details next to an entry to see the faulting application and module.
5. In Event Viewer, read the System and the Application log for the minutes before the time named in event 6008.
6. If one program or driver keeps showing up, update it or remove it.
7. If nothing stands out, start Windows with a clean boot and use it for a day.

The clean boot step by step, and how to bring the services back afterwards: How to perform a clean boot in Windows If Windows hangs so early that you cannot work, start it in Safe Mode first: Start Windows or a Mac in Safe Mode

Fix 9. Windows Server and virtual machines: look for a reset from outside

30 minutesNo riskA Windows Server or a virtual machine logged 6008 and nobody was at the console when it restarted.

A server can be restarted by something that is not inside its own Windows: the virtualization host, a recovery feature of the hardware, or the power feed. The guest then logs only 41 and 6008, and the reason is in another log.

PowerShell: the same history, read from another computer (replace SERVER01)

Get-WinEvent -ComputerName SERVER01 -FilterHashtable @{ LogName='System'; Id=12,13,41,46,86,1001,1074,6005,6006,6008,6009,6013; StartTime=(Get-Date).AddDays(-14) } |
  Sort-Object TimeCreated |
  Format-Table TimeCreated, Id, ProviderName, Message -Wrap

1. Run the command above from your own PC. -ComputerName takes one NetBIOS name, IP address or full domain name at a time.
2. Look for an event 1074 before the restart. It names the process, the account and the reason, so it shows a requested restart such as an update or a management tool.
3. No 1074 and the machine is a Hyper-V guest outside a cluster: check the heartbeat feature. If the host gets no heartbeat from the guest, Hyper-V restarts the virtual machine.
4. In a Hyper-V cluster, check the option Enable heartbeat monitoring for the virtual machine.
5. On a VMware guest, Microsoft points to the VMware heartbeat feature or a third-party cluster. Read the host's log for the time in the 6008 text.
6. On a physical server, check for Automatic Server Recovery (ASR) software that restarts a machine it finds unresponsive.
7. Read the log of the server's management controller for power and hardware faults at that time.

• The real question after a heartbeat reset is why the guest stopped answering. Treat it as a hang: read the guest's System and Application log before the time in the 6008 text.
• Time zones. Microsoft notes that times in a saved .evtx file are shown in your own system's time. Check the server's time zone before you compare logs of two machines.
• Hardware logs. On Dell PowerEdge servers the iDRAC records which component faulted in its Lifecycle Log. Other makers have a log of the same kind.
• Shutdown Event Tracker. On servers this dialog asks for a reason after an unexpected shutdown. It is a result of the same dirty shutdown, not a second problem.
• A hung server and no dump. Microsoft describes a dump triggered by a non-maskable interrupt (NMI) from the server hardware. On Windows Server 2012 and later no registry change is needed for it.

If the shutdowns continue: what to collect and when it is hardware

When 6008 keeps coming back after the fix that matched your pattern, stop changing settings and collect evidence. A repair shop, the PC maker or Microsoft Support can work with facts, not with "it shuts down sometimes".

• The history. The output of the two commands in Fix 1 and Fix 3 for 30 days or more. It shows how often the shutdowns happen and what was installed before the first one.
• Event 41 details. BugcheckCode, PowerButtonTimestamp and SleepInProgress of each event 41.
• Dump files. %SystemRoot%\MEMORY.DMP and the files in %SystemRoot%\Minidump. Microsoft Support may ask for the memory dump when you report a stop error.
• What was going on. Microsoft stresses that event 41 alone is often not enough: note what the PC was doing each time, such as a game, a backup, sleep or nothing.
• Reliability Monitor. The days around each shutdown from perfmon /rel.

Check what the unexpected shutdowns left behind

Microsoft warns that a dirty shutdown can cause data loss or corruption and can lead to startup problems, because files were open and caches were not written. These checks do not remove the cause of event 6008. They repair what the shutdowns may have damaged, so run them once the cause is fixed.

1. Open a command window as administrator and run chkdsk C: to scan the Windows drive without changing anything.
2. If chkdsk reports errors, run the repair as described here: Check a disk for errors (chkdsk)
3. Check the Windows system files with DISM and sfc /scannow: Run DISM and SFC to repair Windows system files
4. Open the documents you were working on when the PC went off and check that they are complete.
5. If Windows no longer starts after a shutdown, use the recovery environment: Run Startup Repair

How to keep Event ID 6008 from coming back

Frequently asked questions

What does Event ID 6008 mean?

It means Windows found at startup that its previous session did not end with a clean shutdown. The event comes from the source EventLog in the System log, has the level Error and reads "The previous system shutdown at [time] on [date] was unexpected." Microsoft calls this an improper or dirty shutdown. The event tells you that it happened and roughly when. It does not tell you why. The reason can be a crash, lost power, overheating, a hang that ended with the power button, or a virtual machine reset by its host.

Is error 6008 in Event Viewer something I have to fix?

Not the event itself. People search for error 6008 or error code 6008, but 6008 is an event number in the System log, not a Windows error code, and no setting repairs it. What may need fixing is the reason the PC went off. A single event after a known power cut, or after you held the power button on a frozen PC, needs no action. Repeated events that you did not cause do: list them together with events 41, 1001 and 1074 as in Fix 1 and follow the pattern you find.

What is the difference between Event ID 41 and Event ID 6008?

Both report the same shutdown from two sides. Event 6008 comes from EventLog, is an Error and gives the time the PC went off. Event 41 comes from Kernel-Power, is Critical and says that the system has rebooted without cleanly shutting down first. Event 41 is the more useful one, because its details can hold a bug check code after a crash, or a power button timestamp after a forced power-off. Microsoft notes that a PC that lost power may log no event 41 at all, so 6008 can also appear alone.

How do I see what caused an unexpected shutdown?

Read the events around it. Run the Get-WinEvent command from Fix 1 in PowerShell as administrator, or filter the System log in Event Viewer by the IDs 12, 13, 41, 1001, 1074, 6008 and 6009. Then open the event 41 of the same start and read BugcheckCode and PowerButtonTimestamp on its Details tab. A code above zero means a crash, and event 1001 gives the path of the dump file. A power button timestamp means a forced power-off. All zeros point to lost power or hardware. Reliability Monitor, opened with perfmon /rel, shows what failed or was installed in the days before.

Why does event 6008 show a different time than the moment it was logged?

Because Windows cannot write anything while it is going down unexpectedly. The event is created at the next start, so its Date and Time column shows when the PC came back. The time inside the text is when Windows was last known to be running. In our screenshot the event was logged at 6:08:08 PM and its text names 5:27:49 PM. Use the time in the text when you search other logs for the cause. We could not confirm from Microsoft how exact that time is, so look a few minutes to either side of it.

Is Event ID 6008 the same on Windows 10, Windows 11 and Windows Server?

Yes. The source, the number and the text are the same, and Microsoft's troubleshooting articles for Windows client and for Windows Server use the same set of events: 41, 1001, 1074, 6008 and 6009. The differences are around it. On Windows 11 you open PowerShell through Terminal (Admin), on Windows 10 through the search box. Windows 10 left support on 14 October 2025. On servers and virtual machines, a restart from outside is an extra cause, covered in Fix 9. In another display language the event text is translated, but the number stays 6008.

Can Event ID 6008 appear after a normal shutdown?

It can. Microsoft documented one case for Windows 2000 only: a locked computer shut down by a program with the force flag logged 6008, because the Event Log service was not told about the shutdown. For current Windows, Microsoft writes that a dirty shutdown event is logged when an application does not answer the shutdown request or ends abnormally. So a 6008 right after a shutdown you started yourself suggests that something was cut off during it. Check for an event 1074 just before, and for a bug check during shutdown in event 41.

Why does a server ask why it shut down unexpectedly after every restart?

That dialog is the Shutdown Event Tracker, and it appears because Windows has a dirty shutdown on record. If it shows after every restart, either each restart really is unclean, which Fix 1 will show as a new 6008 every time, or the record is stale. Microsoft notes that clearing the values under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability, such as DirtyShutdown, LastAliveStamp and TimeStampInterval, can help prevent the tracker from appearing after an unexpected shutdown. Export the key first, and do it only after the real cause is known, because it removes a symptom and not the cause.

Will a system file check, a Windows update or a driver update fix Event ID 6008?

Only when the pattern in the log fits. Updating or rolling back a driver helps when event 1001 shows a bug check that started after a driver change. A Windows update can help with a crash caused by a known bug. A system file check repairs damage that unclean shutdowns left behind, but it does not stop a PC from losing power or overheating. Microsoft states that unexpected shutdowns are mostly caused by components outside the operating system. That is why this guide starts with the log and not with general repairs.