Skip to content
littleden.blogEvidence-led Windows troubleshooting, without the guesswork
FixesError codesComponentsCommandsWindows updatesWindows 11
Research statusMethodology
Diagnostics & reliability · scoped error record
Event ID 41

Kernel-Power: Windows restarted without a clean shutdown

Event ID 41 confirms an unexpected shutdown/restart occurred; it does not by itself name the failed component.

Applies to: Supported Windows client versionsReviewed: 2026-09-17

What it means in this context

Microsoft documents Kernel-Power Event ID 41 as the record Windows creates after it starts and finds that the previous shutdown was not clean. It can follow a stop error, hard reset, hang or loss of power. The event fields and nearby records are needed to choose the next branch.

Start here
  1. Confirm the source is Microsoft-Windows-Kernel-Power and the ID is 41.
  2. Record the event time and any BugcheckCode data.
  3. Check for Event ID 1001 or 6008 at the same restart.
  4. Correlate the first occurrence with recent hardware, driver, firmware or Windows changes.
1

Use the bugcheck fields when Windows captured them

Low risk

Why: A captured stop code moves the investigation to the blue-screen/dump path rather than generic power troubleshooting.

  1. Open the Event ID 41 details.
  2. Record the BugcheckCode if nonzero.
  3. Check WER-SystemErrorReporting Event ID 1001 for the stop code and dump path.
2

Treat zero/no bugcheck as an open power/hang branch

Low risk

Why: Microsoft notes that Event ID 41 may contain zero values when Windows could not write stop-error data before the restart.

  1. Record whether the PC froze, lost power or was hard-reset.
  2. Check thermals, power delivery and vendor hardware diagnostics when symptoms support that path.
  3. Do not infer a specific failed component from Event ID 41 alone.
Scope boundary

When not to use this record

Event ID 41 is not a standalone diagnosis of a bad PSU, driver or motherboard.

If it persists

Use the exact stop code/Event ID 1001 when available; otherwise correlate hardware/power symptoms and the surrounding event timeline.

Evidence

Reviewed source

Related authority records

Continue with the same failing system

These links share the same component or repair context; they are not generic keyword suggestions.

GuideUnexpected restart in Windows 11: use Event ID 41 as a timeline clue, not the diagnosis

Kernel-Power Event ID 41 confirms Windows detected an unclean restart; correlate its fields with bugcheck, power and recent-change evidence before deciding why.

ErrorEvent ID 6008 — EventLog unexpected shutdown: a timestamp clue, not a root cause

Event ID 6008 records that the previous shutdown was unexpected; correlate it with Event ID 41, bugcheck records and the failure timeline.

CommandWEVTUTIL — query recent Event ID 41 records

Read recent matching events from the Windows System log without changing or clearing the log.

ErrorEvent ID 1001 — WER-SystemErrorReporting bugcheck: preserve the stop code and dump path

When Event ID 1001 says the computer rebooted from a bugcheck, the useful evidence is the exact bugcheck code, parameters and saved dump.

GuideApplication keeps crashing in Windows 11: correlate Event ID 1000 with WER and the faulting module

Use repeated Application Error/WER records to identify the failing process, module and exception before reinstalling Windows or unrelated drivers.

ErrorEvent ID 1000 — Application Error: application or service crash record

Preserve the faulting application, module and exception code and correlate repeated Event 1000 entries with Windows Error Reporting Event 1001.