Event ID 41CriticalSystem

Windows Event ID 41 — Kernel Power — Unexpected Shutdown / Crash

Logged when Windows restarts unexpectedly without a clean shutdown — indicates a crash, power failure, or hard reset.

Why It Matters

Repeated unexpected shutdowns indicate hardware instability (overheating, failing PSU, RAM errors), driver bugs, or in rare cases, a kernel-level attack. Each event logs the BugcheckCode that caused the crash.

Key Fields

BugcheckCodeThe stop code — 0x0 means power loss, non-zero codes identify specific crash types
PowerButtonTimestampWhether the power button was held (deliberate hard power-off)

Investigation Tips

  1. 1.BugcheckCode 0x0 = power failure; correlate with UPS logs or power events.
  2. 2.Repeated crashes with the same non-zero BugcheckCode point to a specific driver or hardware failure.
  3. 3.Check for Event ID 1001 (WER) which provides the full crash dump analysis.

See Event ID 41 in your logs

Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.

Decode an event →
← All detection guides·Decode an event →