Windows Event ID 1074 records who or what cleanly initiated a restart or shutdown. Logged by the User32 source in the System log, it names the process, the user account, the reason code, and the shutdown type. It's the go-to event for confirming a planned reboot and for spotting one that shouldn't have happened.
Key takeaways
- Event 1074 logs clean, initiated restarts and shutdowns, not crashes or power loss.
- It names the process, account, shutdown type, and a reason code, so it answers who rebooted the machine and why.
- The reason code is a bitmask; the 0x80000000 planned flag, not a magic lookup value, tells you planned from unplanned.
- For uncontrolled shutdowns, pair it with Kernel-Power Event 41 and Event 6008, which fire when 1074 doesn't.
- An out-of-hours 1074 from an unexpected process or account is worth a closer look.
Quick explanation
In simple terms
A System log entry that records when someone or something told Windows to restart or shut down, and why.
Technical definition
An informational User32 event in the System event log, raised when a caller invokes the shutdown API (ExitWindowsEx or InitiateSystemShutdownEx). It carries the initiating process, the acting account, a reason-code bitmask, the shutdown type, and an optional comment.
Analogy
Think of it as the office sign-out sheet by the door. It records who left and the reason they wrote down, but only for people who actually used the door. If the power fails and everyone's forced out, nothing gets written on the sheet.
Definition
Windows Event ID 1074 is an informational System-log event, written by the User32 source, that records when a user, application, or the operating system cleanly initiates a restart or shutdown. It names the process, the account, the shutdown type, and a reason code.
Windows Event ID 1074 is an informational event in the System log, written by the User32 source, when a restart or shutdown is initiated through the Windows shutdown API. It records the process that made the request, the computer, the account it acted on behalf of, a reason code, the shutdown type (restart, shutdown, or power off), and an optional comment.
The key word is initiated. Event 1074 fires only for clean, software-driven shutdowns: a user clicking Start, an app or service calling ExitWindowsEx, Windows Update, or a shutdown.exe command. It's written early, before Windows tears anything down, so it survives even if the shutdown later stalls.
What it doesn't cover is an uncontrolled stop. A crash, hard power-off, or power loss never reaches the API, so no 1074 appears. Those show up instead as Kernel-Power Event 41 and Event 6008 on the next boot. Treat 1074 as the record of who asked for a reboot, not proof that one finished.
Why it matters
Core concepts
Only clean, initiated shutdowns
Event 1074 appears only when a shutdown or restart is requested through the Windows shutdown API, not when the system stops uncontrolled.
Event 1074 is raised by the shutdown code path in Windows, so it only appears when a shutdown or restart is requested through the API. That includes a user choosing Restart, an application or service calling ExitWindowsEx, a shutdown.exe command, a remote reboot, or Windows Update finishing an install.
Because it's written at the start of the sequence, before services stop, it's a reliable marker of intent. But it also means an uncontrolled stop leaves no trace here. A bugcheck (BSOD), a held power button, or a pulled plug never calls the API, so you get Event 41 and 6008 later instead.
Example
A reboot from shutdown.exe /r writes a 1074; yanking the power cord writes nothing here, only a 6008 on the next boot.
Why it matters — Knowing 1074 covers only initiated shutdowns stops you from hunting for a crash cause in an event that never records crashes.
The fields inside the event
Each 1074 carries a process, computer, user, reason text, reason code, shutdown type, and optional comment.
Each 1074 packs the same set of fields, shown in the General tab and the raw XML. The description reads like a sentence:
The process [process] has initiated the [restart|shutdown] of computer [computer] on behalf of user [domain\user] for the following reason: [reason]. Reason Code: [code]. Shutdown Type: [type]. Comment: [comment]The process is the executable that made the request, such as explorer.exe, winlogon.exe, or shutdown.exe. The user is the account it acted for, which may be a person or a service account. The shutdown type is restart, shutdown, or power off. The comment is free text, often supplied by a script or the Shutdown Event Tracker.
Example
explorer.exe on behalf of CONTOSO\jsmith usually means that user picked Restart from the Start menu.
Why it matters — The process and account fields are what let you tell an interactive reboot from a scripted or remote one.
The reason code is a bitmask, not an error code
The reason code combines a planned flag, optional UI flags, a major reason, and a minor reason into one value.
The Reason Code looks like an error code but isn't. Per Microsoft's System Shutdown Reason Codes documentation, it's a bitwise OR of a planned flag, optional UI flags, a major reason, and a minor reason.
Take a real value, 0x84020004. It breaks down as:
0x80000000planned flag: the shutdown was planned0x04000000clean-UI flag: the reason dialog was shown0x00020000major reason: Operating System0x00000004minor reason: Reconfiguration
Windows renders that as Operating System: Reconfiguration (Planned). The same human meaning can appear as different hex values depending on which flags are set, which is why a fixed lookup table of magic numbers tends to mislead.
Example
0x80040002 decodes to planned + Application + Installation, or *Application: Installation (Planned)*.
Why it matters — Reading the code by its parts, not from a static table, is the only way to interpret it correctly across machines.
Planned versus unplanned
The 0x80000000 planned flag is the reliable signal for whether a shutdown was planned.
The single most useful bit in the reason code is 0x80000000, the planned flag. When it's set, the shutdown was planned; when it's absent, it was unplanned. That flag, not the specific reason text, is the reliable signal.
Where do reasons come from? On servers, the Shutdown Event Tracker prompts for one at shutdown, and shutdown.exe /d p|u:xx:yy lets scripts pass major and minor codes directly. Without either, a reboot is often logged with a generic reason and an empty comment, which is common for scripted or remote restarts.
Example
Filtering 1074 on the 0x80000000 bit set separates maintenance windows from reboots that need explaining.
Why it matters — The planned flag lets you split routine maintenance from restarts that warrant a look, without decoding every value.
How it works
A caller requests the shutdown
A user, app, service, or command invokes the Windows shutdown API, ExitWindowsEx or InitiateSystemShutdownEx, and passes a reason code. shutdown.exe and the Start menu are just front ends to the same API.
Shutdown request
Example — shutdown /r /t 60 /d p:4:1
User32 writes Event 1074
Before Windows begins tearing down the session, the User32 source records Event 1074 in the System log with the process, account, reason code, and shutdown type. Writing it first is what makes it survive a stalled shutdown.
1074 logged
Example — The process shutdown.exe has initiated the restart of computer SRV01...
Windows shuts down cleanly
Services and the session stop in order. On a clean shutdown, the Event Log service records Event 6006, "The Event log service was stopped", as the last entry before power-off.
6006 clean marker
Example — Event 6006 follows the 1074 on a clean shutdown
The next boot confirms the outcome
When the machine comes back, a clean cycle shows boot markers like Event 6005, 6009, and 13. If the previous shutdown was uncontrolled, Windows logs Kernel-Power Event 41 and Event 6008 instead, the tell-tale absence of a matching 1074.
Boot and outcome
Example — Crash path: 41 then 6008, with no 1074
Use cases
Confirming planned maintenance
IT adminsVerify that a server restart was deliberate and see which process and account started it.
Filter the System log on Event 1074 for the maintenance window, then confirm each reboot shows the planned flag and an expected process.
Benefit — A clear, attributable record that a reboot was intended.
Building a reboot history
MSPsAssemble a per-device timeline of restarts and shutdowns across a fleet.
Collect 1074 (initiated) with 6005 and 6006 (boot and clean-shutdown markers) into a central store for uptime reporting.
Benefit — Uptime and reboot patterns you can report on per device.
Investigating suspicious restarts
Security teamsSpot reboots initiated by unexpected processes or accounts, especially outside maintenance windows.
An out-of-hours 1074 from shutdown.exe under a service account, correlated with a recent 7045 service install, is worth a closer look.
Benefit — An early signal of a forced reboot used to load persistence or clear memory.
Explaining a surprise reboot
Help deskAnswer the common 'my PC restarted on its own' question by naming what triggered it.
A 1074 from a servicing process with an Operating System reason usually points to a Windows Update restart.
Benefit — A quick, factual answer for end users without guesswork.
Benefits
Written before teardown
Because 1074 is logged at the start of the sequence, it's present even when the shutdown later hangs, unlike events written at the end.
A stalled shutdown still leaves a 1074 behind.
Names the who and the how
It records both the initiating process and the acting account, so you can tell a user reboot from a scripted or remote one.
explorer.exe under a user versus shutdown.exe under SYSTEM.
Structured and filterable
The reason code and shutdown type are machine-readable, which makes filtering and SIEM alerting straightforward.
Alert on 1074 where the planned flag is absent.
Consistent across versions
The same event and fields appear on Windows 10, Windows 11, and Windows Server 2016 through 2025.
One filter works across a mixed fleet.
Limitations
Blind to crashes and power loss
HighUncontrolled shutdowns never call the shutdown API, so they produce no 1074. Relying on it alone will miss every crash and hard power-off.
Workaround — Pair 1074 with Event 6008 and Kernel-Power Event 41 to catch uncontrolled shutdowns.
Reasons are only as good as the caller
MediumScripted and remote reboots often pass a generic reason code and no comment, so the 'why' can be thin.
Workaround — Enable the Shutdown Event Tracker and use shutdown.exe /d with major and minor codes plus a comment.
Custom reason text needs registration
LowCustom major and minor reasons only render as text if those codes are defined on the machine; otherwise you see the raw numbers.
Workaround — Define custom reason codes on each machine, or stick to the built-in reasons.
Multiple entries per shutdown
LowMore than one process can initiate a shutdown sequence, so a single reboot can log several 1074 entries.
Workaround — De-duplicate by timestamp; treat entries within a few seconds as one event.
Architecture
Event 1074 rarely tells the whole story alone. It sits in a small family of System-log events that, read together, reconstruct any restart or shutdown: who started it, whether it was clean, and what happened on the way back up.
Event ID 1074 (User32)
Records a clean, initiated restart or shutdown with process, account, reason, and type.
The process shutdown.exe has initiated the restart...
Event ID 6006
The Event Log service stopped: the marker of a clean shutdown, and the usual partner to a 1074.
The Event log service was stopped
Event ID 6005 / 6009 / 13
Boot markers used to time when the machine came back online.
The Event log service was started
Event ID 6008
Logged on the next boot when the previous shutdown was unexpected. Its presence without a 1074 signals an uncontrolled stop.
The previous system shutdown was unexpected
Event ID 41 (Kernel-Power)
Fires for crash- or power-driven shutdowns and carries a BugcheckCode. A non-zero code is a BSOD; 0x0 points to raw power loss.
The system has rebooted without cleanly shutting down first
Event ID 1076
Records the reason an admin supplies after an unexpected shutdown, once they log back in.
Reason given by the first user with shutdown rights
Data flow
A healthy maintenance reboot flows 1074 then 6006, then boot markers like 6005 and 13. A crash or power loss flows Kernel-Power 41 then 6008 on the next boot, with no 1074 in between. That contrast, the presence or absence of a 1074, is the fastest way to classify any reboot.
Integrations: Windows Event Forwarding (WEF) for central collection, SIEM correlation with logon Event 4624 and service-install Event 7045, Shutdown Event Tracker for prompted reasons
Architecture limitations
Examples
Decoding a real reason code
You open a 1074 and see Reason Code 0x84020004.
Break the value into its parts: 0x80000000 (planned) + 0x04000000 (clean UI) + 0x00020000 (major: Operating System) + 0x00000004 (minor: Reconfiguration).
Windows shows this as Operating System: Reconfiguration (Planned), a deliberate reconfiguration reboot.
A scripted remote reboot
A 1074 shows `shutdown.exe` on behalf of a service account at 3 a.m., with a generic reason and an empty comment.
The initiating process and off-hours timing are the signal here, not the reason text.
Correlate the event with logon Event 4624 and any nearby service-install Event 7045 to judge whether the reboot was authorized.
Update reboot versus user reboot
Two reboots in the log: one initiated by `explorer.exe` under a user, one by a servicing process with an Operating System reason.
The process and reason code separate the two. A user's Start-menu restart comes from explorer.exe; an automatic update restart comes from a servicing process with an OS-major reason.
Comparisons
Event ID 1074 vs Event ID 6008
Event 1074 records a clean, initiated shutdown with who and why. Event 6008 records, after the fact, that the previous shutdown was unexpected, with no initiator or reason.
| Criterion | Event ID 1074 | Event ID 6008 |
|---|---|---|
| When it's written | At shutdown, before teardown begins | On the next boot, after an unclean stop |
| What it names | Process, account, reason code, shutdown type | Only that the prior shutdown was unexpected |
| Covers crashes | No, initiated shutdowns only | Yes, that's its whole purpose |
Event ID 1074 vs Event ID 41 (Kernel-Power)
Event 1074 marks an intentional, API-driven shutdown. Kernel-Power Event 41 marks a shutdown the OS didn't perform cleanly and carries a BugcheckCode pointing to a crash or power loss.
| Criterion | Event ID 1074 | Event ID 41 (Kernel-Power) |
|---|---|---|
| Trigger | A caller invokes the shutdown API | The system rebooted without a clean shutdown |
| Cause detail | Reason code supplied by the caller | BugcheckCode: non-zero is a BSOD, 0x0 is power loss |
| Logged by | User32, in the System log | The kernel (Kernel-Power), in the System log |
Myths, corrected
Myth
Event 1074 logs system crashes and power failures.
Correction
It doesn't. Event 1074 is raised only for clean shutdowns that go through the shutdown API. A crash, bugcheck, or power loss never reaches that code, so no 1074 is written. Those events surface as Kernel-Power Event 41 and Event 6008 on the following boot. If you're chasing a crash, 1074 is the wrong place to look.
Why it happens: People group every 'why did it reboot' event together, and some references mislabel reason codes that carry the planned flag as 'unexpected shutdowns'.
Myth
The reason code is an error code you can match to a fixed table.
Correction
The reason code is a bitmask, not an error code. It combines a planned flag, optional UI flags, a major reason, and a minor reason. The same meaning can appear as several different hex values depending on the flags set, so a static table of magic numbers often points to the wrong cause. Decode the parts, and use the 0x80000000 planned flag as the reliable planned-versus-unplanned signal.
Why it happens: Hex reason codes look like error codes, and many blog posts publish inconsistent lookup tables copied from each other.
Myth
A 1074 always means a person did it.
Correction
Not necessarily. Applications, services, Windows Update, and scripted or remote commands all initiate 1074 events. The phrase 'on behalf of user' can name a service account or the context a scripted call ran under. Read the process and account fields together to tell an interactive reboot from an automated one.
Why it happens: The 'on behalf of user' wording reads as human intent even when the initiator is software.
Practical implications
For admins
Filter the System log on Event 1074 to confirm planned reboots and see which process and account started them. Combine it with 6006 to confirm the shutdown was clean.
For MSPs
Across a fleet, 1074 gives a clean maintenance-reboot history per device. Forward it to a central log store so the trail outlives the System log rollover.
For business
For change management and audits, 1074 is the record that a server restart was planned and attributable, which many compliance frameworks expect.
For security
An out-of-window 1074 from an unexpected process or account can flag a forced reboot used to load persistence or clear memory. Correlate with logon Event 4624 and service-install Event 7045.
For end users
It answers the common 'my PC restarted on its own' question by naming what triggered it, usually an update or a scheduled task.
Cost impact
None directly. It's a built-in event with no license cost; the only overhead is log storage if you forward it centrally.
Operational impact
Low. Reading and forwarding these events adds negligible load, and filtering keeps the noise down.
Decision guide
Use when
- Confirming a restart was planned and by whom
- Building a reboot or uptime history per device
- Correlating restarts with logon and persistence events
- Satisfying change-management and audit requirements
Avoid when
- Diagnosing the root cause of a crash or BSOD
- Measuring exact downtime between shutdown and boot
- Attributing a hard power-off with no clean-shutdown markers
Requirements
- Read access to the System event log
- Shutdown Event Tracker enabled for richer reasons
- WEF or a SIEM for central collection and alerting
Alternatives
- Kernel-Power Event 41 for crash and power-loss causes
- Event 6008 for confirming an unexpected shutdown
- Event 6006 and 6005 to measure clean-shutdown and boot times
- Event 1076 for the reason logged after an unexpected shutdown
Related terms
User32
The Windows subsystem component that hosts the shutdown UI and logs Event 1074 when a shutdown or restart is initiated.
A Windows feature that prompts for a reason at shutdown and records it in Event 1074. On by default on Windows Server.
The Win32 API a process calls to log off, shut down, or restart, passing the reason code that lands in Event 1074.
The 0x80000000 bit in a shutdown reason code that marks a shutdown as planned.
Event ID 6008
A System-log event written on the next boot when the previous shutdown was unexpected.
Event ID 41 (Kernel-Power)
A kernel event for crash- or power-driven shutdowns that carries a BugcheckCode.
Event ID 6006
The Event Log service stopped: the marker of a clean shutdown that usually follows a 1074.
Event ID 1076
Records the reason an admin gives after an unexpected shutdown, once they sign back in.
Frequently asked questions
What is Windows Event ID 1074?
Event ID 1074 is an informational event in the Windows System log, written by the User32 source, when a user, application, or the operating system cleanly initiates a restart or shutdown. It records the initiating process, the account, a reason code, the shutdown type, and an optional comment, so it answers who asked the machine to reboot and why.
Does Event ID 1074 mean the system crashed?
No. Event 1074 is logged only for clean shutdowns that go through the Windows shutdown API. Crashes, bugchecks, and power loss never reach that code, so they don't produce a 1074. An uncontrolled stop shows up as Kernel-Power Event 41 and Event 6008 on the next boot instead.
How do I tell if a shutdown was planned or unplanned?
Check the planned flag in the reason code, 0x80000000. When that bit is set, the shutdown was planned; when it's absent, it was unplanned. Don't rely on matching the full hex value to a fixed table, since the same meaning can appear as different codes depending on the flags.
What's the difference between Event 1074, 6006, and 6008?
Event 1074 records a clean, initiated shutdown and names the process, account, reason, and type. Event 6006 confirms the Event Log service stopped cleanly, the usual partner to a 1074. Event 6008 is logged on the next boot when the previous shutdown was unexpected. A clean reboot shows 1074 then 6006; an uncontrolled one shows a 6008 with no matching 1074.
Why do I see multiple Event 1074 entries for one shutdown?
More than one process can enter the shutdown path. A user's click can be followed by winlogon.exe or another service calling the API as the sequence runs. Each entry is a distinct initiation, even though they belong to the same reboot. When parsing, treat entries within a few seconds of each other as one event.
Can Event 1074 help detect unauthorized or malicious reboots?
Yes. Because it names the initiating process and account, an out-of-hours 1074 from an unexpected process, such as shutdown.exe under a service account, or a remote reboot, is worth investigating. Attackers force reboots to load startup persistence or clear memory. Correlate the event with logon Event 4624 and any nearby service-install Event 7045.
How do I query Event 1074 with PowerShell?
Use Get-WinEvent against the System log:
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 20Each event's Message holds the readable description, and ToXml() exposes the individual fields, including the process, account, and reason code, for structured parsing.
Why is the reason blank or generic on some 1074 events?
That usually means no reason was supplied. Scripted or remote reboots often pass a generic reason code with an empty comment, and on clients the Shutdown Event Tracker is off by default, so nothing prompts for one. Enable the tracker, or pass shutdown.exe /d with major and minor codes and a comment, to get richer detail.
Conclusion
Windows Event ID 1074 is the record of a clean, initiated restart or shutdown. Written by User32 in the System log before anything tears down, it names the process, the account, the shutdown type, and a reason code. Read the reason code by its parts, and lean on the 0x80000000 planned flag to separate routine maintenance from reboots that need explaining. Just remember what it can't see: crashes and power loss leave no 1074, only Event 41 and 6008 on the way back up.
Main takeaway
When a reboot has no matching 1074, move to Kernel-Power Event 41 and Event 6008 to investigate an unexpected shutdown.
