Log Dejargonizer

Windows System Log · Event 1076

Event 1076: Someone typed a reason for the last unexpected shutdown

After a machine restarts unexpectedly, Windows can ask the first administrator who signs in why it happened. Event 1076 records their answer. It is the only free-text human explanation in the System log — and its timestamp is when they typed it, not when the crash happened.

Also written as Event ID 1076Shutdown Event Tracker reasonUser32 1076

What it means for you

On a personal computer

You will almost never see this on a home PC, because the prompt that produces it — the Shutdown Event Tracker — is switched off on Windows 10 and 11. If you do see it, someone turned it on through Group Policy, or you are looking at a server.

For an analyst

Two things make it worth knowing. First, its timestamp is the logon time, so using it to date an outage will be wrong by however long the machine sat at the sign-in screen. Second, it is attributable: unlike 6008 and 41, it carries a user name, which makes it the only record in the System log that tells you who was present after the incident and what they believed had happened.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Log Name:      System
Source:        User32
Event ID:      1076
Level:         Information
User:          CORP\jbrooks
Computer:      APP-SRV-02

The reason supplied by user CORP\jbrooks for the last unexpected shutdown of this computer is: Other (Unplanned)
Reason Code: 0x0
Bug ID:
Bugcheck String:
Comment: UPS failed during the power test, server lost power.

The fields that decide it

Everything else in the log line is context.

User
Who supplied the reason. This is what distinguishes 1076 from every other shutdown event — it names a person rather than a subsystem.
Reason Code
A major and minor code pair from the Shutdown Event Tracker's list, rendered as text such as 'Other (Unplanned)' or 'System Failure: Stop error'.
  • System Failure: Stop errorThe person attributed it to a blue screen. Cross-check against Event 1001 BugCheck.
  • Power Failure: Cord UnpluggedAttributed to loss of power, which is the most common honest answer.
  • Other (Unplanned)The default when nobody picks a category. Read the comment instead.
Comment
Free text typed by the administrator. Often the single most informative line in the whole log — and equally often blank or a full stop.
Shutdown Type
Whether the tracked event was a restart or a shutdown.

Ordinary reasons this happens

Most of the time it is one of these.

  • A planned power cut, a UPS test, or datacentre maintenance, recorded honestly by whoever came back afterwards.
  • A hard reset performed deliberately because the machine had hung.
  • A virtual machine reset from the hypervisor, which the guest cannot distinguish from a power failure.
  • A blue screen, where the administrator selected the stop-error reason code.
  • Somebody clicking through the prompt to make it go away, which is why the reason text is frequently useless.

When it is not ordinary

A reboot used to load a tampered driver or to clear volatile evidence, explained away in the comment.

What gives it awayThe comment attributes the restart to something mundane, but Event 1001 BugCheck is absent, no power event corresponds, and 7045 or 7040 records around the same boot show a driver or service that changed.

ATT&CK T1542

Forced restarts to interrupt a defensive tool or a running response action.

What gives it awayRepeated unexpected shutdowns on one host with 1076 reasons that do not match any hardware or power evidence, and a pattern of restarts occurring while investigation activity was in progress.

ATT&CK T1529

What to do next

  1. Do not treat the timestamp as the time of the outage. It is when someone signed in and answered the prompt, which can be hours or days later.
  2. Find the actual shutdown: Event 6008 records the last unexpected shutdown with its real time, and Event 41 records that the previous shutdown was not clean.
  3. Read the comment. It is unstructured and often thin, but when it is good it is better than anything else in the log.
  4. Check for Event 1001 from the BugCheck source at the boot in question. If a blue screen happened, a dump exists and the reason code should agree with it.
  5. Compare the named user against who should have had access to that machine at that time.
  6. If you want this prompt on a fleet, enable it via Computer Configuration > Administrative Templates > System > 'Display Shutdown Event Tracker'; if you want to stop it appearing, disable the same setting.

Queries to run

powershell The comment is only in the rendered message, so Format-List is what you want rather than a table. 
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1076} -MaxEvents 20 | Format-List TimeCreated, UserId, Message
powershell Builds a shutdown timeline. 6008 gives the real outage time, 1076 gives the human explanation, and the gap between them is the time nobody was logged on. 
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074,1076,6006,6008,41} -MaxEvents 100 | Sort-Object TimeCreated | Select-Object TimeCreated, Id, ProviderName
kql Across a fleet, this is a short list of every machine where somebody had to explain a crash. 
Event | where EventID == 1076 | project TimeGenerated, Computer, UserName, RenderedDescription | order by TimeGenerated desc

Common questions

Why does Windows ask me to explain why my computer shut down?

That is the Shutdown Event Tracker. When it is enabled, the first user with shutdown rights to sign in after an unexpected restart is prompted for a category and a comment, and the answer is written as Event 1076. It is on by default on Windows Server and off by default on Windows 10 and 11, so on a client machine it means somebody enabled it through Group Policy.

Does Event 1076 tell me when my computer crashed?

No, and this trips people up regularly. The timestamp on Event 1076 is the moment somebody signed in and answered the prompt, which may be long after the crash. For the actual time of the outage, use Event 6008, which records when the unexpected shutdown occurred, or Event 6005 for when the machine came back up.

How do I turn off the shutdown reason prompt?

Set Computer Configuration > Administrative Templates > System > 'Display Shutdown Event Tracker' to Disabled in Group Policy, or set ShutdownReasonOn to 0 under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability. On Windows Server, turning it off also stops the prompt that appears when you shut down normally.

What is the difference between Event 1074 and Event 1076?

1074 records a shutdown or restart that was requested properly — it names the process and user that asked. 1076 records a human's explanation of a shutdown that was never requested at all. If you see both around one incident, 1074 is the planned action and 1076 is somebody accounting for an unplanned one.

Read next

Vendor documentation

Last reviewed 7 September 2026