How to determine if the last shutdown was due to power failure in windows?

windows-server-2008 windows-server-2008-r2 windows-7

52,855

Solution 1

In the System event log, look for EventID 41 Kernel-Power. It's description is:

The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

That sounds like what you're looking for, correct?

Solution 2

You can create a custom event viewer view of the System log and restrict the source to

Source: Microsoft-Windows-Kernel-Power

These should notify you about power-loss and subsequent power-restored events.

52,855

unlimit

Updated on September 18, 2022

Comments

unlimit almost 2 years

I know I can get logs of shutdowns from the eventlog when the shutdown is proper and initiated by the user or due to software upgrades. But how do I determine if the last shutdown was due power failure, over heating etc?
Zapto almost 12 years

Also if the system was shut down cleanly there will allways be 3 events "Event Log" in a row. One stopping one stopped and one starting.
unlimit almost 12 years

Is there any way to know when the last shutdown happened due to the reasons mentioned in my question?
MDMarra almost 12 years

You can have a scheduled task with that event as a trigger and have it send an email or do whatever else you want.
unlimit almost 12 years

I was thinking of creating a service and maybe do a "touch" on a file every n minutes and then compare its last modified date with the event timestamp to figure this out. Do you think this will be efficient or do you have any better way?
MDMarra almost 12 years

Why do you need that, there's a time listed with the event...
unlimit almost 12 years

If the machine got shutdown because of a power failure, I don't think any event will be generated. Then how will I know when the shutdown happened? And it may be hours before the machine is turned on again. This machine will be run in a place where power is very erratic. I need both the boot time and shutdown(for any reason) time for a report.
unlimit almost 12 years

You mean in case of power failure a event is generated, can you please explain as to how can I dig this out? I checked eventid 41, only bootup time is present, not when the shutdown happened.