Windows Event ID 10001 – WinInit: System Shutdown Initiated by User

Start by examining the specific Event ID 10001 entries to understand shutdown patterns and sources.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. In the Actions pane, click Filter Current Log
4. Enter 10001 in the Event IDs field and click OK
5. Double-click any Event ID 10001 entry to view detailed information
6. Review the General tab for timestamp, user context, and process information
7. Check the Details tab for additional XML data about the shutdown source

Use PowerShell to programmatically analyze Event ID 10001 occurrences and extract detailed information.

1. Open PowerShell as Administrator
2. Run the following command to retrieve recent Event ID 10001 entries:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=10001} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -AutoSize

3. For more detailed analysis, use this command to export events to CSV:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=10001} -MaxEvents 100 | Select-Object TimeCreated, Id, LevelDisplayName, UserId, ProcessId, @{Name='Message';Expression={$_.Message}} | Export-Csv -Path "C:\Temp\Event10001.csv" -NoTypeInformation

4. To analyze events from the last 7 days:

$StartTime = (Get-Date).AddDays(-7)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=10001; StartTime=$StartTime} | Group-Object {$_.TimeCreated.Date} | Sort-Object Name

Enable enhanced logging to capture more detailed information about shutdown events and their sources.

1. Open Local Group Policy Editor by running gpedit.msc
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand System Audit Policies → System
4. Double-click Audit System Integrity
5. Check both Success and Failure options
6. Click OK and close Group Policy Editor
7. Open Command Prompt as Administrator and run:

gpupdate /force

8. To verify the policy is active, run:

auditpol /get /subcategory:"System Integrity"

Create a PowerShell monitoring solution to track and alert on Event ID 10001 patterns.

1. Create a new PowerShell script file: C:\Scripts\ShutdownMonitor.ps1
2. Add the following monitoring code:

# Shutdown Monitor Script
$LogName = "System"
$EventID = 10001
$Hours = 24

$StartTime = (Get-Date).AddHours(-$Hours)
$Events = Get-WinEvent -FilterHashtable @{LogName=$LogName; Id=$EventID; StartTime=$StartTime} -ErrorAction SilentlyContinue

if ($Events) {
    $EventCount = $Events.Count
    $LatestEvent = $Events[0]
    
    Write-Host "Found $EventCount shutdown events in the last $Hours hours"
    Write-Host "Latest shutdown: $($LatestEvent.TimeCreated)"
    
    # Optional: Send email alert if too many shutdowns
    if ($EventCount -gt 5) {
        Write-Warning "Excessive shutdown activity detected!"
    }
} else {
    Write-Host "No shutdown events found in the last $Hours hours"
}

3. Create a scheduled task to run this script:

$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\ShutdownMonitor.ps1"
$Trigger = New-ScheduledTaskTrigger -Daily -At "09:00AM"
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
Register-ScheduledTask -TaskName "ShutdownMonitor" -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM"

Perform comprehensive analysis by correlating Event ID 10001 with related events across multiple log sources.

1. Open PowerShell as Administrator and create a correlation script:

# Multi-log correlation for shutdown analysis
$TimeWindow = (Get-Date).AddHours(-2)

# Get shutdown events
$ShutdownEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=10001; StartTime=$TimeWindow}

# Get related security events (logon/logoff)
$SecurityEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=@(4624,4634); StartTime=$TimeWindow} -ErrorAction SilentlyContinue

# Get application errors near shutdown time
$AppErrors = Get-WinEvent -FilterHashtable @{LogName='Application'; Level=2; StartTime=$TimeWindow} -ErrorAction SilentlyContinue

foreach ($shutdown in $ShutdownEvents) {
    Write-Host "\n=== Shutdown Event at $($shutdown.TimeCreated) ==="
    
    # Find security events within 5 minutes
    $RelatedSecurity = $SecurityEvents | Where-Object { 
        [Math]::Abs(($_.TimeCreated - $shutdown.TimeCreated).TotalMinutes) -lt 5 
    }
    
    if ($RelatedSecurity) {
        Write-Host "Related Security Events:"
        $RelatedSecurity | Format-Table TimeCreated, Id, Message -AutoSize
    }
    
    # Find application errors within 10 minutes before shutdown
    $RelatedErrors = $AppErrors | Where-Object {
        ($shutdown.TimeCreated - $_.TimeCreated).TotalMinutes -gt 0 -and
        ($shutdown.TimeCreated - $_.TimeCreated).TotalMinutes -lt 10
    }
    
    if ($RelatedErrors) {
        Write-Host "Application Errors Before Shutdown:"
        $RelatedErrors | Format-Table TimeCreated, ProviderName, Id, LevelDisplayName -AutoSize
    }
}

2. For registry-based investigation, check shutdown reason codes:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability" -Name "LastComputerName" -ErrorAction SilentlyContinue