Event ID 6008: The previous system shutdown was unexpected

Written at boot when the previous shutdown was not clean: a crash, power loss or forced reset.

Log: System
Category: System

Why it matters

Unexpected shutdowns around an incident can point to crashes from exploitation or to someone pulling the power.

What to check

Check the time of the previous shutdown and any 41 (Kernel-Power) or crash events.

How to turn it on

Logged by default.