Windows Event ID 1042 – Kernel-Power: System Reboot Without Clean Shutdown

Start by examining events surrounding the Event ID 1042 to identify the root cause:

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Right-click in the log pane and select Filter Current Log
4. In the Event IDs field, enter: 1042, 41, 6008, 1074 to see shutdown-related events
5. Click OK to apply the filter
6. Examine events chronologically around each Event ID 1042 occurrence
7. Look for preceding critical errors, warnings about hardware, or driver issues

Use PowerShell for automated analysis:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1042} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Windows Reliability Monitor provides a graphical timeline of system events including unexpected shutdowns:

1. Press Win + R and type perfmon /rel to open Reliability Monitor
2. Review the stability chart for red X marks indicating critical events
3. Click on dates showing critical events to see detailed information
4. Look for patterns in hardware failures, application crashes, or Windows failures
5. Note any correlation between software installations and subsequent Event ID 1042 occurrences

Generate a reliability report using PowerShell:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1001} | Where-Object {$_.Message -like '*critical*'} | Select-Object TimeCreated, Message | Format-Table -Wrap

Export reliability data for analysis:

wevtutil epl System C:\temp\system_events.evtx "/q:*[System[EventID=1042]]"
wevtutil qe C:\temp\system_events.evtx /f:text > C:\temp\event_1042_analysis.txt

Investigate hardware-related causes of unexpected shutdowns:

1. Open Device Manager by pressing Win + X and selecting Device Manager
2. Look for devices with yellow warning triangles or red error marks
3. Check System devices for power management controller issues
4. Right-click problematic devices and select Properties → Events tab

Run hardware diagnostics using PowerShell:

# Check system temperature and power events
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-Power'} -MaxEvents 50

# Check for thermal events
Get-WinEvent -FilterHashtable @{LogName='System'; Id=37} -MaxEvents 10

# Verify power policy settings
powercfg /query SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMAX

Check power supply and UPS status:

# Check battery/UPS events if applicable
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Battery'} -MaxEvents 20

# Review power button events
Get-WinEvent -FilterHashtable @{LogName='System'; Id=109} -MaxEvents 10

Enable detailed shutdown logging to capture more information about unexpected reboots:

1. Open Registry Editor by pressing Win + R, typing regedit, and pressing Enter
2. Navigate to HKLM\SYSTEM\CurrentControlSet\Control\CrashControl
3. Create or modify the DWORD value DisplayParameters and set it to 1
4. Navigate to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability
5. Create DWORD ShutdownReasonUI and set to 1 to prompt for shutdown reasons

Enable verbose shutdown logging via Group Policy or registry:

# Enable shutdown event tracker
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" -Name "ShutdownReasonOn" -Value 1 -Type DWord

# Configure automatic restart settings
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "AutoReboot" -Value 0 -Type DWord

Set up custom event log monitoring:

# Create scheduled task to log Event ID 1042 occurrences
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-Command \"Add-Content -Path C:\\logs\\shutdown_events.log -Value \"$(Get-Date): Event ID 1042 detected\"\""
$trigger = New-ScheduledTaskTrigger -AtStartup
Register-ScheduledTask -TaskName "Monitor-Event1042" -Action $action -Trigger $trigger -RunLevel Highest

Deploy advanced monitoring to prevent and quickly identify causes of unexpected shutdowns:

1. Configure Windows Performance Toolkit (WPT) for detailed system tracing
2. Set up Performance Monitor counters for power management and thermal monitoring
3. Implement PowerShell-based monitoring scripts for real-time alerting

Create a comprehensive monitoring script:

# Advanced Event ID 1042 monitoring and analysis script
$logPath = "C:\\logs\\system_monitoring.log"
$emailAlert = "admin@company.com"

# Monitor for Event ID 1042 and related events
$events = Get-WinEvent -FilterHashtable @{
    LogName='System'
    Id=1042,41,6008,1074
    StartTime=(Get-Date).AddDays(-1)
} | Sort-Object TimeCreated

foreach ($event in $events) {
    $logEntry = "$(Get-Date): Event ID $($event.Id) - $($event.LevelDisplayName) - $($event.TimeCreated)"
    Add-Content -Path $logPath -Value $logEntry
    
    if ($event.Id -eq 1042) {
        # Send alert for unexpected shutdown
        Send-MailMessage -To $emailAlert -Subject "Critical: Unexpected Shutdown Detected" -Body "Event ID 1042 logged at $($event.TimeCreated)" -SmtpServer "mail.company.com"
    }
}

Configure system health monitoring:

# Set up performance counters for power and thermal monitoring
$counterPath = "\\Thermal Zone Information(*)\\Temperature"
$powerCounters = "\\Power Management\\*"

# Create data collector set
logman create counter "SystemHealth" -f bincirc -max 500 -c $counterPath $powerCounters -si 60
logman start "SystemHealth"