Windows Event ID 6008 – EventLog: Unexpected System Shutdown Detection

Start by examining the System log around the time of the unexpected shutdown to identify potential causes:

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Look for Event ID 6008 entries and note their timestamps
4. Examine events immediately before the shutdown time for clues:
   • Event ID 41 (Kernel-Power): Indicates power-related issues
   • Event ID 1001 (BugCheck): Shows BSOD information
   • Critical or Error events from hardware drivers
5. Use PowerShell to filter relevant events:

Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2,3} | Where-Object {$_.TimeCreated -gt (Get-Date).AddDays(-7)} | Sort-Object TimeCreated

This method provides immediate context about what caused the unexpected shutdown.

Use Windows Reliability Monitor to get a comprehensive view of system stability issues:

1. Press Win + R, type perfmon /rel, and press Enter
2. Review the reliability chart for red X marks indicating critical events
3. Click on dates with critical events to see detailed information
4. Look for patterns in unexpected shutdowns over time
5. Export reliability data for analysis using PowerShell:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=6008} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Export-Csv -Path "C:\temp\shutdown_events.csv" -NoTypeInformation

Alternative command to check reliability data:

Get-CimInstance -ClassName Win32_ReliabilityRecords | Where-Object {$_.EventIdentifier -eq 6008} | Select-Object TimeGenerated, Message

This provides historical context and helps identify recurring patterns.

Examine hardware-related logs and system information to identify potential hardware causes:

1. Check Windows Hardware Error Architecture (WHEA) logs:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WHEA-Logger'} | Select-Object TimeCreated, Id, LevelDisplayName, Message

2. Review Kernel-Power events for power-related issues:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-Power'} | Where-Object {$_.Id -eq 41} | Select-Object TimeCreated, Message

3. Check system temperature and hardware status using built-in tools:

Get-CimInstance -ClassName Win32_TemperatureProbe
Get-CimInstance -ClassName Win32_Fan
Get-CimInstance -ClassName Win32_Processor | Select-Object Name, CurrentTemperature

4. Examine power settings and UPS configuration:

powercfg /query
Get-CimInstance -ClassName Win32_Battery | Select-Object Name, BatteryStatus, EstimatedChargeRemaining

Enable detailed shutdown tracking to capture more information about future unexpected shutdowns:

1. Configure shutdown event tracker via Group Policy or registry:

# Enable shutdown event tracker via registry
Set-ItemProperty -Path "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" -Name "ShutdownReasonOn" -Value 1 -Type DWord
Set-ItemProperty -Path "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" -Name "ShutdownReasonUI" -Value 1 -Type DWord

2. Enable verbose boot and shutdown logging:

# Enable boot logging
bcdedit /set bootlog yes
# Enable shutdown event logging
Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "BootExecute" -Value @("autocheck autochk *", "bootlog")

3. Configure automatic crash dump collection:

# Set system to create memory dumps on crashes
Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "CrashDumpEnabled" -Value 1
Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "DumpFile" -Value "%SystemRoot%\MEMORY.DMP"

4. Set up custom event log monitoring:

# Create scheduled task to monitor Event ID 6008
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command Get-WinEvent -FilterHashtable @{LogName='System'; Id=6008} | Select-Object -First 1 | Out-File C:\temp\last_unexpected_shutdown.txt"
$Trigger = New-ScheduledTaskTrigger -AtStartup
Register-ScheduledTask -TaskName "Monitor_Unexpected_Shutdowns" -Action $Action -Trigger $Trigger

Deploy advanced monitoring to proactively detect and prevent unexpected shutdowns:

1. Set up PowerShell-based monitoring script:

# Advanced monitoring script for unexpected shutdowns
$LogName = "System"
$EventID = 6008
$LastCheck = (Get-Date).AddHours(-24)

$UnexpectedShutdowns = Get-WinEvent -FilterHashtable @{
    LogName = $LogName
    Id = $EventID
    StartTime = $LastCheck
} -ErrorAction SilentlyContinue

if ($UnexpectedShutdowns) {
    $Report = $UnexpectedShutdowns | ForEach-Object {
        [PSCustomObject]@{
            TimeCreated = $_.TimeCreated
            Computer = $_.MachineName
            EventID = $_.Id
            Message = $_.Message
        }
    }
    
    # Send email alert or log to central monitoring system
    $Report | Export-Csv -Path "C:\Monitoring\UnexpectedShutdowns_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
    
    # Optional: Send to Windows Event Log for centralized monitoring
    Write-EventLog -LogName Application -Source "Custom Monitoring" -EventId 1001 -EntryType Warning -Message "Detected $($UnexpectedShutdowns.Count) unexpected shutdowns in the last 24 hours"
}

2. Configure Windows Performance Toolkit for detailed analysis:

# Install and configure WPT for shutdown analysis
# Download from Microsoft and install Windows Performance Toolkit
# Create custom trace for shutdown events
wpr -start GeneralProfile -start CPU -start DiskIO

3. Set up centralized logging with custom PowerShell module:

# Create custom function for shutdown analysis
function Analyze-UnexpectedShutdowns {
    param(
        [int]$DaysBack = 30,
        [string]$ComputerName = $env:COMPUTERNAME
    )
    
    $Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{
        LogName = 'System'
        Id = 6008
        StartTime = (Get-Date).AddDays(-$DaysBack)
    } -ErrorAction SilentlyContinue
    
    if ($Events) {
        $Analysis = @{
            TotalEvents = $Events.Count
            FirstOccurrence = ($Events | Sort-Object TimeCreated)[0].TimeCreated
            LastOccurrence = ($Events | Sort-Object TimeCreated -Descending)[0].TimeCreated
            AveragePerDay = [math]::Round($Events.Count / $DaysBack, 2)
            ComputerName = $ComputerName
        }
        
        return [PSCustomObject]$Analysis
    }
}