Windows Event ID 6 – Kernel-General: System Shutdown Initiated

Start by examining the Event ID 6 details and surrounding events to understand the shutdown context.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 6 in the Event IDs field and click OK
5. Double-click the most recent Event ID 6 to view detailed information
6. Note the timestamp and examine events occurring 5-10 minutes before the shutdown
7. Look for related events like Event ID 1074 (user shutdown), 1076 (shutdown reason), or application error events

Leverage PowerShell to query and analyze Event ID 6 occurrences for patterns and trends.

1. Open PowerShell as Administrator
2. Query recent Event ID 6 entries:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=6} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -AutoSize

3. Analyze shutdown frequency over the past 30 days:

   $shutdowns = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6; StartTime=(Get-Date).AddDays(-30)}
   $shutdowns | Group-Object {$_.TimeCreated.Date} | Sort-Object Name | Format-Table Name, Count

4. Export shutdown data for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=6} -MaxEvents 100 | Export-Csv -Path "C:\temp\shutdown_events.csv" -NoTypeInformation

5. Correlate with Event ID 1074 for user-initiated shutdowns:

   $timeRange = (Get-Date).AddHours(-1)
   Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074; StartTime=$timeRange} | Format-List TimeCreated, Message

Enable enhanced shutdown logging to capture more detailed information about future shutdown events.

1. Open Registry Editor as Administrator
2. Navigate to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability
3. Create a new DWORD value named ShutdownReasonOn and set it to 1
4. Navigate to HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability
5. Create a DWORD named ShutdownReasonUI and set it to 1 to enable shutdown reason dialog
6. Configure Group Policy for enhanced logging:
   • Open gpedit.msc
   • Navigate to Computer Configuration → Administrative Templates → System
   • Enable Display Shutdown Event Tracker
7. Restart the system for changes to take effect

Set up Windows Event Forwarding to centrally monitor Event ID 6 across multiple systems.

1. Configure the collector server:

   winrm quickconfig
   wecutil qc

2. Create a custom subscription XML file:

   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
     <SubscriptionId>ShutdownMonitoring</SubscriptionId>
     <SubscriptionType>SourceInitiated</SubscriptionType>
     <Description>Monitor Event ID 6 shutdowns</Description>
     <Enabled>true</Enabled>
     <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
     <Query><![CDATA[<QueryList><Query Id="0"><Select Path="System">*[System[EventID=6]]</Select></Query></QueryList>]]></Query>
   </Subscription>

3. Import the subscription:

   wecutil cs shutdown_monitoring.xml

4. Configure source computers to forward events:

   winrm set winrm/config/client @{TrustedHosts="CollectorServerName"}

5. Verify subscription status:

   wecutil gs ShutdownMonitoring

Use Windows Performance Analyzer and Event Tracing for Windows for deep shutdown analysis.

1. Install Windows Performance Toolkit from Windows SDK
2. Create a custom ETW session for shutdown tracking:

   wpr -start GeneralProfile -start CPU -start DiskIO

3. Reproduce the shutdown scenario or wait for the next occurrence
4. Stop the trace after shutdown:

   wpr -stop C:\temp\shutdown_trace.etl

5. Analyze the trace with WPA:

   wpa C:\temp\shutdown_trace.etl

6. In WPA, load the System Activity graph and filter for shutdown-related events
7. Examine the timeline leading up to Event ID 6 to identify triggering processes
8. Cross-reference with Process and Thread Activity to identify the shutdown initiator
9. Export findings for documentation:

   wpa -i C:\temp\shutdown_trace.etl -o C:\temp\shutdown_analysis.txt -profile shutdown_analysis.wpaProfile