Log Dejargonizer

Windows System Log · Event 41

Event 41: The system rebooted without shutting down cleanly

Windows noticed on startup that the previous shutdown never happened properly — the machine lost power, froze, or crashed. The event records the aftermath, not the cause, which is why it so rarely explains anything by itself.

Also written as Event ID 41Kernel-Power 41Kernel Power 41 63

What it means for you

On a personal computer

Your PC turned off without warning and Windows is telling you it noticed. A single one after a power cut means nothing. Several a week means something is wrong — most often the power supply, overheating, or memory, and much less often software.

For an analyst

On physical hardware, treat it as a hardware or power question. On virtual machines it usually means the host reset the guest, so check the hypervisor rather than the guest. Correlate with BugCheck 1001 to distinguish a stop error from a bare power loss.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

BugcheckCode: 0
BugcheckParameter1: 0x0
BugcheckParameter2: 0x0
BugcheckParameter3: 0x0
BugcheckParameter4: 0x0
SleepInProgress: 0
PowerButtonTimestamp: 0
BootAppStatus: 0

The fields that decide it

Everything else in the log line is context.

BugcheckCode
The stop error code, if Windows managed to record one before dying.
  • 0No stop error was recorded. The machine lost power or froze rather than crashing in a way Windows could log.
PowerButtonTimestamp
Non-zero when the power button was held down to force the machine off.
  • 0The power button was not held. Something else caused the shutdown.
BugcheckParameter1
The first stop-error parameter, meaningful only when a bugcheck code is present.
SleepInProgress
Whether the machine was entering or leaving sleep when it happened. A recurring pattern here points at power management or drivers rather than hardware.

Ordinary reasons this happens

Most of the time it is one of these.

  • A power cut, or a plug or power strip knocked out.
  • Holding the power button to force a machine off that appeared frozen.
  • A laptop battery reaching zero without a clean hibernate.
  • A virtual machine reset from the hypervisor, which the guest experiences as a sudden power loss.
  • Pulling the plug on a machine that seemed hung during an update.

When it is not ordinary

A crash caused by unstable or malicious kernel-level software.

What gives it awayRepeated Event 41 with a non-zero bugcheck code, particularly shortly after new software or a driver was installed.

ATT&CK T1499

Deliberate disruption of a server.

What gives it awayRepeated unexplained resets on a machine that is otherwise healthy, clustered in time or coinciding with other suspicious activity.

ATT&CK T1529

What to do next

  1. Read the bugcheck code. Zero means no stop error was recorded, which points at power or a hard freeze rather than a software crash.
  2. Check whether the power button timestamp is non-zero — if someone held the button, that is the answer.
  3. Look in the System log immediately before the restart for disk, thermal, or hardware warnings.
  4. Check for a matching Event 1001 from BugCheck, which carries the actual stop code if Windows managed to write a dump.
  5. On a virtual machine, check the hypervisor's own logs instead. The guest cannot see what the host did to it.
  6. If it repeats on physical hardware, test memory and check the power supply and temperatures before suspecting software.

Queries to run

powershell The last twenty unclean shutdowns with their bugcheck codes. Property positions vary between Windows versions — check the XML if the values look wrong. 
Get-WinEvent -FilterHashtable @{LogName='System'; Id=41} -MaxEvents 20 | Select-Object TimeCreated, @{n='Bugcheck';e={$_.Properties[1].Value}}, @{n='PowerButton';e={$_.Properties[5].Value}}
powershell The week's errors and criticals together. What appears immediately before each Event 41 is usually the real story. 
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddDays(-7)} | Where-Object { $_.LevelDisplayName -in 'Error','Critical' } | Select-Object TimeCreated, Id, ProviderName, Message | Format-Table -Wrap
wevtutil No PowerShell needed. Reads the last ten straight off the log. 
wevtutil qe System /q:"*[System[(EventID=41)]]" /f:text /c:10 /rd:true

Common questions

Is Kernel-Power Event 41 serious?

Only if it repeats. It means the machine went down without a clean shutdown, which after a power cut or a held power button is entirely expected. Several a week with no obvious cause points at a real hardware problem — usually the power supply, overheating, or failing memory.

How do I fix Kernel-Power Event 41?

There is nothing to fix in the event itself; it is a symptom. Work through the physical causes first — check the power connections, run a memory test, clean out dust and check temperatures, and make sure the power supply is adequate. If the bugcheck code is not zero, chase that stop code instead, because then it is a software or driver crash rather than a power problem.

What does BugcheckCode 0 mean in Event 41?

It means Windows never got as far as recording a stop error. The machine lost power or froze hard rather than crashing in a controlled way. That effectively rules out a normal blue screen and points at power, heat, or hardware.

Why do I get Event 41 on a virtual machine?

Because the hypervisor reset or powered off the guest, and from inside the guest that is indistinguishable from pulling the plug. The explanation is in the host's logs, not the virtual machine's — a host restart, a live migration failure, or a resource limit are the usual causes.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026