Power Cycling errors event log

Question

Wondering if anyone can tell me what to do about all of the errors I'm getting that are causing the system to reboot. Here is a copy of the Event log that seems to define the issue, but I don't understand where to start with it. Looks like an activation issue, but my activation is good. I've attached an xml version of the event log. Wouldn't let me attach the evtx version of it. Please let me know if this can be read, and if you can, what it means I need to do to fix this. Thank you. :)

Answer 1

Please check to see if your PC is producing any Watchdog dump files, I will check those to see if they provide any insight into a potential cause of the system crashes.

Open Windows File Explorer.

Navigate to C:\Windows\LiveKernelReports

If there are any Watchdog dump files in the sub-folders of that folder, copy the files onto your Desktop, then zip those up.

Upload the zip file to the Cloud (OneDrive... etc.), then choose to share those and get a share link.

Then post the link here to the zip file, so I can take a look for you.

Answer 2

To troubleshoot repeated power-cycle reboots and errors in the event log on Windows 11, start by identifying exactly what type of reboot is occurring and then correlate it with other events around the same time.

1. Identify whether reboots are normal or unexpected

• Open Event Viewer → Windows Logs → System.
• Filter by Event IDs 12, 13, 6005, and 6009 to see reboot history and frequency:
  • 12 (Kernel-General): OS started.
  • 13 (Kernel-General): OS is shutting down.
  • 6005 (EventLog): Event log service started.
  • 6009 (EventLog): OS version at boot. These show when the system is starting and shutting down and help confirm how often reboots occur.

2. Check for unexpected reboots and their causes

• In the same System log, filter for Event IDs 19, 41, 1001, 1074, and 7045:
  • 41 (Kernel-Power): System rebooted without a clean shutdown (power loss, crash, or hang).
  • 1001 (WER-SystemErrorReporting): “The computer has rebooted from a bugcheck…” with a bugcheck code and MEMORY.DMP path.
  • 6008 (EventLog): Previous shutdown was unexpected.
  • 1074 (User32): A process or user initiated a shutdown/restart, with a reason code.
  • 19 and 7045: Often indicate driver or service installation/updates.

Interpretation:

• If Event ID 41 and 6008 appear without 1074, the system is crashing or losing power rather than being intentionally restarted.
• If 1001 (WER-SystemErrorReporting) appears with a bugcheck code and MEMORY.DMP path, the reboots are due to bug checks (BSODs). In that case:
  • Note the bugcheck code (for example, 0xXXXXXXXX) and the dump file path (usually C:\Windows\MEMORY.DMP).
  • Investigate recent driver or service changes around the first occurrence by checking for Event ID 7045 (service installed) or other driver-related events.

3. Use Windows Error Reporting for upgrade/activation-related events If the reboots started after a Windows upgrade or update and you see Event ID 1001 with Event Name WinSetupDiag02 in the Application log:

• Open Event Viewer → Windows Logs → Application.
• Find Event ID 1001 with event name WinSetupDiag02.
• This event lists parameters P1–P10, including:
  • P5: Result Error Code (for example, 0xc1900101).
  • P6: Extend Error Code. These codes indicate upgrade/setup failures and can point to driver or compatibility issues rather than activation problems.

4. Correlate with driver or service changes

• In System log, look for Event ID 7045 (“A service was installed in the system”) around the time the reboots began.
• If a new driver or service appears shortly before the first bugcheck or Event ID 41, that driver/service is a likely cause. Rolling back or removing that driver/service can help confirm.

5. Next steps based on findings

• If Event ID 41/1001 show bugchecks:
  • Use the bugcheck code and MEMORY.DMP for deeper analysis or share the dump with support.
  • Check for recent driver updates (especially storage, chipset, GPU, or third-party security/monitoring tools) and roll back or update them.
• If Event ID 1074 shows a process initiating shutdowns:
  • Review the process name and reason code to see if a specific application or update is forcing restarts.
• If the logs show repeated driver/service installs (Event ID 7045) just before crashes:
  • Remove or roll back those drivers/services and monitor if reboots stop.

This approach uses the event IDs and their descriptions to move from “many errors” to a specific cause: power loss, bugcheck (driver/hardware), or software-initiated shutdowns. Once the pattern is identified, focus on the driver, service, or update that appears just before the first unexpected reboot.

---

References:

• Troubleshoot unexpected reboots using system event logs
• Advanced troubleshooting for Event ID 41: "The system has rebooted without cleanly shutting down first"
• Windows Error Reporting
• Writing to the System Event Log