A custom filter can be created to show Windows shutdown events which can be used to help troubleshoot or isolate an incident when a system was rebooted or shutdown in error or by normal means. Use the following method below to create a custom filter in Windows Event Viewer.
- Open Windows Event Viewer (command line:
eventvwr.msc) - Navigate to Windows Logs > System
- Right click on System and choose Filter Log…
- Use the following EventIDs:
41,1074,6006,6008 - Click OK
