Event Logs: Why Did It Restart?

Windows writes what happens to it in event logs, and Get-WinEvent -FilterHashtable finds the events you want by log, event ID, level and start time, so the five restart IDs, 41, 1074, 6005, 6006 and 6008, tell a planned restart from a crash or a power cut.

Updated

Cheat sheet for the lesson Event Logs: Why Did It Restart?: Windows writes what happens to it in event logs, and Get-WinEvent -FilterHashtable finds the events you want by log, event ID, level and start time, so the five restart IDs, 41, 1074, 6005, 6006 and 6008, tell a planned restart from a…
Category
PowerShell
Level
Journeyman
Tags
event-id, event-log, event-viewer, get-winevent, hashtable, operating-system, powershell