# Event Logs: Why Did It Restart?

Windows writes what happens to it in event logs, and Get-WinEvent -FilterHashtable finds the events you want by log, event ID, level and start time, so the five restart IDs, 41, 1074, 6005, 6006 and 6008, tell a planned restart from a crash or a power cut.

![Cheat sheet for the lesson Event Logs: Why Did It Restart?: Windows writes what happens to it in event logs, and Get-WinEvent -FilterHashtable finds the events you want by log, event ID, level and start time, so the five restart IDs, 41, 1074, 6005, 6006 and 6008, tell a planned restart from a…](https://fsdtrainingmedia.blob.core.windows.net/public/images/2026/11/4bf918a7f17d40778052a819bfee9dc3.webp)

- Category: PowerShell
- Level: Journeyman
- Tags: event-id, event-log, event-viewer, get-winevent, hashtable, operating-system, powershell
- Updated: November 10, 2026

Source: https://www.ask-codey.com/cheat-sheets/powershell-event-logs-cheat-sheet