How do I identify the root cause of unexpected reboots?

Question

In the last few months, my computer has started rebooting seemingly at random. It cuts out instantly, as if I'd pressed the reset button, and boots up as normal. There are no common traits I can identify; sometimes it happens in games, sometimes in applications, sometimes just at the desktop with nothing demanding happening at all. There is no indication of updates, installations, electrical anomalies or temperature spikes that coincide with the reboots, nor are there any BSODs or dump files to be found.

The Event Viewer is singularly unhelpful; I get criticals from Kernel-Power that "The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly." (Event ID 41, Critical, category 63, keywords (70368744177664),(2)) These messages are typically timestamped about 15 seconds before the log time of the reboot.

On the subsequent restart I'll get an error from EventLog that "The previous system shutdown at was unexpected." (Event ID 6008, Error, no category, keywords Classic) There will also be an information event from Kernel-Boot that "The last shutdown's success status was false. The last boot's success status was true."

My computer runs Win 10 (64-bit), with an Asus Z370-P, an Intel 8700 running at 3.20 GHz, 16 GB of Corsair RAM, and a GeForce GTX 960.

I've tried using Performance Monitor and various other systems to look for the usual signs of instability, but without luck. I'd rather avoid having to rebuild the whole system if at all possible.

Any advice?

Answer 1

Analyzing elusive restarts is very hard, because many causes are possible. I list below some steps which might help localize the problem.

Windows tools

• The Event Viewer (already analyzed by the poster)

• Reliability Monitor, accessed via Start > View reliability history. A red X denotes a problem, so click on it for details. Clicking "View technical details" gives more information.

• Undo Windows Automatic Restart to have more time to see the error message (if there is one). This is done in Control Panel > System > Advanced system settings > Advanced > Startup and Recovery > Settings, uncheck "Automatically restart", click OK.

• chkdsk

• sfc /scannow

• Update device drivers (download them where appropriate from the manufacturer's website)

Hardware

• Unplug every possible device to reduce the possibilities

• Check the SMART data of the disk by a utility such as Speccy

• Check for heating problems of the CPU and GPU. Useful utilities are SpeedFan, HWMonitor and the Open Hardware Monitor, but there are many others.

• Run Memtest86 or Memtest86+ for as many iterations as you can.

Answer 2

Please try the following steps:

• Open event viewer
• expand Windows Logs
• click on system to view it
• right-click on system and select Filter Current Log
• in Event Sources: select User32
• change <All Event IDs> to 1074
• click OK

You'll now have a list of shutdown and reboot events. scroll through them and you should be able to see what process caused which reboot. The information will look like this example:

The Process "C:\Windows\system32\svchost.exe (COMPUTERNAME)" has initiated a reboot on behalf of "NT-AUTHORITY\SYSTEM" for the following reason: "Operatingsystem: Service Pack (planned)" Reason code: "0x80020010" Shutdown type: "reboot" Comment: ""

Here's a picture of the Filter to use in eventviewer, from my german system:

Answer 3

It seems like Windows is just as surprised as you are that it's been shut down.

That is often the symptom of a hardware failure, since most kinds of software failures would leave some sort of clue in your event log. (Normally from a BSOD)

Here's a couple things you could try:

• Try a different power bar.
  Unplug everything but the PC from that power outlet to be sure the problem is the PC itself.
• Use a power supply tester to see if the PSU is providing the correct voltages.
• If you have a spare PSU, try running the PC from that one instead.
• Run a temperature monitoring app that records temperature to a file. Some CPU models can cause an instant system shutdown/reboot if they get too hot.
• Try to run a live OS from a usb stick without storage drives and just the bare-minimum hardware connected. If the problem still occurs then you at least narrowed it down to your CPU, motherboard, RAM, or PSU.
• Run a CPU & GPU intensive stress test to see if you can reproduce the shutdown quicker. (Will help you narrow down the problem & save time troubleshooting.)

Answer 4

Alternate suggestion: the issue is related to software installed to your system.

I would reboot into safe mode and allow the computer to run without shutting down for an amount of time longer than the average it takes to reboot. If it does not unexpectedly reboot, start disabling an application/service that starts up with Windows. These can be found in Task Manager and Services; you'll want to start with 3rd party services that come with user-installed applications.

To reboot into safe-mode, run msconfig and tick 'Safe mode' in the Boot section. Untick it and reboot to turn off safe mode when you're done diagnosing.

To open Task Manager, run Tskmgr.exe. To open Services, run services.msc.

In the past I have attempted to load a custom library to an older application and would have the system freeze seconds after loading, with the event viewer similarly having no useful information.

Answer 5

The most possible symptoms of unexpected reboot are hardware failures, and they do random or frequently depending on usage. For example in this case could be memory...

I will try to check with these live CD tools here

You have to do by exclusion of hardware and finally if you don't get succesfully try some tools like Live CDs.

The first one and second one are great...

Answer 6

Based on the information given, there's no Stop Error generated after the restart, and no dumps that point to a specific process causing the reboot.

I've seen this error happening a lot in production environments of PCs that are connected with external HW devices, which perform power-heavy operations. The most common reason in all instances was the power supply, and after replacing it the problem was resolved.

As suggested on Microsoft's Documentation - Event ID 41, the power-supply is one of the common reasons for this to be happening and is not that uncommon especially in areas where there might be big temperature fluctuations (such as the UAE).

I'd suggest to:

1. Replace the power-supply and monitor the behavior.
2. Disconnect any power-intensive HW that might be connected to the PC and monitor the behavior.