Skip to content
littleden.blogEvidence-led Windows troubleshooting, without the guesswork
FixesError codesComponentsCommandsWindows updatesWindows 11
Research statusMethodology
Windows command reference

WEVTUTIL — query recent Event ID 41 records

Read recent matching events from the Windows System log without changing or clearing the log.

Risk: LowReviewed: 2026-09-17
wevtutil qe System /q:"*[System[(EventID=41)]]" /c:5 /rd:true /f:text

When to use it

Use when you need a repeatable text query for recent Kernel-Power Event ID 41 entries before correlating them with other restart records.

When not to use it

Do not use wevtutil clear-log or configuration-changing options as part of normal diagnosis; clearing logs destroys useful troubleshooting history.

Primary reference

Reviewed source

Related authority records

Continue with the same failing system

These links share the same component or repair context; they are not generic keyword suggestions.

ErrorEvent ID 41 — Kernel-Power: Windows restarted without a clean shutdown

Event ID 41 confirms an unexpected shutdown/restart occurred; it does not by itself name the failed component.

GuideUnexpected restart in Windows 11: use Event ID 41 as a timeline clue, not the diagnosis

Kernel-Power Event ID 41 confirms Windows detected an unclean restart; correlate its fields with bugcheck, power and recent-change evidence before deciding why.

ErrorEvent ID 6008 — EventLog unexpected shutdown: a timestamp clue, not a root cause

Event ID 6008 records that the previous shutdown was unexpected; correlate it with Event ID 41, bugcheck records and the failure timeline.

GuideApplication keeps crashing in Windows 11: correlate Event ID 1000 with WER and the faulting module

Use repeated Application Error/WER records to identify the failing process, module and exception before reinstalling Windows or unrelated drivers.

ErrorEvent ID 1000 — Application Error: application or service crash record

Preserve the faulting application, module and exception code and correlate repeated Event 1000 entries with Windows Error Reporting Event 1001.

ErrorEvent ID 1002 — Application Hang: the app stopped interacting with Windows

Treat Application Hang evidence as proof of a non-responsive process state, then correlate the process, report ID, wait chain and WER record before assigning cause.