#system-shutdown

Windows Event ID 6 – Kernel-General: System Shutdown Initiated

Event ID 6 from Kernel-General indicates a system shutdown has been initiated. This informational event logs when Windows begins the shutdown process, providing essential audit trail information for system administrators.

Windows Event ID 1104 – Microsoft-Windows-Eventlog: Event Log Service Shutdown

Event ID 1104 indicates the Windows Event Log service is shutting down, typically during system shutdown, restart, or service maintenance operations.

Windows Event ID 10001 – WinInit: System Shutdown Initiated by User

Event ID 10001 from WinInit indicates a system shutdown was initiated by a user or process. This informational event logs shutdown requests and helps track system restart patterns.

Windows Event ID 6006 – EventLog: Event Log Service Stopped

Event ID 6006 indicates the Windows Event Log service has stopped. This informational event fires during normal system shutdown or when the EventLog service is manually stopped.