Log Dejargonizer

Windows System Log · Event 6008

Event 6008: The previous system shutdown was unexpected

Windows is reporting that the last time the machine went down, it was not asked to. The useful part is the timestamp, which tells you exactly when the machine stopped — and that is what you compare the rest of the logs against.

Also written as 6008Event ID 6008

What it means for you

On a personal computer

Your PC shut down without being told to — a power cut, a freeze, or a crash. One is nothing. A pattern means something is wrong with the hardware or the power supply.

For an analyst

The timestamp is the value here. Use it as the boundary marker when reconstructing what a machine was doing when it went down, since everything after it belongs to the next boot.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
The previous system shutdown at 09:14:02 on 28/08/2026 was unexpected.

The fields that decide it

Everything else in the log line is context.

Time of shutdown
The moment the machine actually stopped, written into the message text. This is why the event is worth reading at all.
Record time
When the event was written, which is during the following boot rather than at the time of the shutdown itself.

Ordinary reasons this happens

Most of the time it is one of these.

  • A power cut or an unplugged cable.
  • Holding the power button on a frozen machine.
  • A laptop battery running flat.
  • A hypervisor resetting a virtual machine.
  • A blue screen, which produces this alongside the crash records.

What to do next

  1. Note the shutdown time from the message and use it as your boundary marker.
  2. Read the System log in the minutes before that time for hardware or driver warnings.
  3. Check for Event 41 and Event 1001 covering the same incident.
  4. If it repeats, count how often and look for a pattern in time of day or workload.
  5. On a virtual machine, check the host rather than the guest.

Queries to run

powershell The message carries the actual shutdown time, which the TimeCreated field does not. 
Get-WinEvent -FilterHashtable @{LogName='System'; Id=6008} -MaxEvents 20 | Select-Object TimeCreated, Message | Format-List
powershell The full startup and shutdown history together. Clean shutdowns pair 1074 with 6006; unclean ones show 6008 with no 6006 before them. 
Get-WinEvent -FilterHashtable @{LogName='System'; Id=6005,6006,6008,1074} -MaxEvents 100 | Sort-Object TimeCreated | Select-Object TimeCreated, Id, Message

Common questions

What is the difference between Event 6008 and Event 41?

They describe the same incident from different components. 6008 comes from the event log service and gives you the time the machine stopped. 41 comes from the kernel power manager and adds the bugcheck code and whether the power button was held. Read 41 for the cause and 6008 for the timing.

How do I find out what caused an unexpected shutdown?

Take the shutdown time from the 6008 message and read the System log backwards from that moment. Disk errors, thermal warnings, and driver failures in the minutes beforehand are the usual culprits. If Event 1001 exists for the same incident, the stop code there is a much more direct answer.

Why does Event 6008 appear after a normal restart?

It should not. A deliberate restart writes Event 1074 and then 6006 for a clean shutdown. If you get 6008 after what looked like a normal restart, the machine failed to shut down properly — often because something hung during the shutdown and Windows was forced to give up on it.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026