Windows PowerShell · Event 403
PowerShell Event 403: A PowerShell session ended
The PowerShell engine shut down. Read on its own it says nothing. Read as the closing bracket on Event 400 it gives you a session length, and session length is one of the few behavioural signals available on a machine with no other PowerShell logging.
Also written as PowerShell 403powershell engine shutdown eventEvent ID 403 powershell
- How oftenFires often
- Vendor calls itInformation
- LogWindows PowerShell
- SourcePowerShell
The fields that decide it
Everything else in the log line is context.
- RunspaceId
- The identifier shared with the Event 400 that opened this session. Subtracting the two timestamps gives the session duration.
- NewEngineState
- Always 'Stopped' for this event. PreviousEngineState will normally read 'Available'; anything else means the engine did not reach a usable state before ending.
- HostApplication
- The command line again. Because the classic log is small and wraps, the 403 sometimes survives after its 400 has already rolled off — in that case this is where the command line is recovered from.
- SequenceNumber
- Increments per event within the log. A gap across a period where PowerShell was clearly running is a hint that the log wrapped rather than that nothing happened.
Common questions
What does 'Engine state is changed from Available to Stopped' mean?
A PowerShell session finished and the engine shut down. It is the normal end of every PowerShell process, including the ones Windows starts for its own maintenance, and by itself it indicates nothing wrong.
Why do I see Event 403 with no matching Event 400?
Usually because the classic Windows PowerShell log has wrapped and the older start event has already been overwritten — the log defaults to a modest size and a busy machine cycles it in days. Less often it means the log was cleared, which shows as Event 104 in the System log. Either way the missing half is worth noticing, because it caps how far back your PowerShell history really goes.
Can I work out how long a PowerShell script ran from these events?
Yes, and it is one of the few things this log gives you for free. Match the RunspaceId in Event 400 to the one in Event 403 and take the difference between the timestamps. Very short sessions are typical of one-line commands and installers; a session that stayed open for hours on a server nobody administers interactively is worth explaining.
Should I increase the size of the Windows PowerShell log?
On any machine you might have to investigate, yes. The default size means the classic log often holds only a few days, and on an unprepared host these events are the entire PowerShell record. Raising the maximum size costs almost nothing and is the cheapest improvement available to a host with no script block logging.
Read next
- Read alongside PowerShell Event 400: A PowerShell session started The engine start event. The pair is what makes either one useful.
- Read alongside PowerShell Event 600: A PowerShell provider started Provider lifecycle events from the same session, which say more about what the session was for.
- Related Event 104: An event log was cleared Clearing an event log, the deliberate way these records disappear rather than merely wrapping.
- The equivalent of PowerShell Event 4104: Script block logging Script block logging, which records what the session actually did rather than when it began and ended.
Vendor documentation
Last reviewed 6 September 2026