How to check what happened, in two minutes
Open the System log, filter it to the day it happened, and look for Event ID 41 from Kernel-Power at the time of the restart. Then read the ten minutes before it — that is where the cause lives, if the machine had time to record one.
Open Event Viewer
Windows + R, typeeventvwr.msc, press Enter. No administrator rights needed for this.Go to Windows Logs → System
This is where power, driver and kernel events are recorded. The Application log will not help here.
Filter to Critical and Error
Filter Current Log…in the Actions pane, setLoggedto the right period and tickCriticalandError. To go straight to the point, put41,1001,6008in the Event IDs box.Find the restart, then read backwards
Event 41 marks the boot after the failure, so its timestamp is when the machine came back. What matters is everything logged in the minutes before it.
The three events that describe a restart
Three events describe an unexpected restart between them, and which of them are present is the first fork in the diagnosis.
| Event | Source | What it tells you |
|---|---|---|
| 41 | Kernel-Power | The system rebooted without shutting down cleanly. Always present after an unexpected restart. |
| 6008 | EventLog | The previous shutdown was unexpected, with the time the machine went down. Useful because it timestamps the failure, not the recovery. |
| 1001 | BugCheck | A blue screen occurred, with the stop code. If this is present, the system crashed — it did not lose power. |
What Event ID 41 actually means
Event ID 41 is written on the next boot, when Windows notices the previous session never ended properly. It is a statement about the shutdown, not about the cause — which is why the answer is never “fix Event 41”.
Microsoft’s own documentation for the event is direct about this: it means the system rebooted without cleanly shutting down first, and it lists power interruptions, crashes and hangs as possibilities without choosing between them (Microsoft Learn). Everything useful comes from the detail attached to it and from what preceded it.
That detail is worth opening. In the event’s Details tab, BugcheckCode is the number that separates the two big branches: a non-zero value means the kernel crashed and a stop code exists; zero means Windows simply stopped getting power or stopped responding.
Reading the clues: crash, power, or heat
Match what you see against the four patterns below. They cover the overwhelming majority of unexpected restarts on home PCs.
| What the log shows | What it means | Where to look next |
|---|---|---|
| 41 together with BugCheck 1001 | A genuine blue screen. Windows crashed and had time to record it. | The stop code in 1001, and the dump in C:\Windows\Minidump |
| 41 with BugcheckCode 0 and nothing before it | The machine lost power or froze hard. Nothing was recorded because nothing was running to record it. | Power delivery and temperatures |
| WHEA-Logger entries around the restart | The hardware itself reported an error. Event 18 is an uncorrected fault; 17 and 19 are errors that were corrected. | Memory, CPU, and anything recently overclocked |
| Repeated errors from one driver or service before the restart | Something was failing for a while before the system gave up. | That component, and any update installed just before it started |
Check what changed
Before spending an evening on hardware, filter the System log for the days before the first restart. A driver update, a new device, a Windows update or a newly installed program in that window is the single most likely explanation, and the cheapest to undo.
The usual causes, in the order worth checking
When the log points at power or heat rather than a crash, work through these in order. It goes cheapest-and-most-likely first, which is not the order the internet usually suggests.
- Power delivery. The wall socket, the extension lead, the cable, and the power supply under load. Restarts that happen only while gaming or rendering — never at idle — fit a supply that cannot hold up under demand.
- Heat and dust. Thermal protection cuts power in hardware, so the log stays empty. Watch CPU and GPU temperatures during the workload that triggers it; a laptop that restarts only on a soft surface is telling you something.
- Memory. Run
mdsched.exe, the Windows Memory Diagnostic, which tests RAM on the next boot. Faulty memory produces restarts with no pattern, at any load, and often varied stop codes. - Graphics drivers. The most common software cause. Roll back a recent driver update, or reinstall cleanly.
VIDEO_TDR_FAILUREandDisplay driver stopped respondingentries nearby confirm it. - Storage and file system.
Ntfs 55or repeateddisk 153entries justify achkdsk— after a backup, not before. A drive failing under load can take the system down with it.
Overclocking, including memory profiles enabled in the BIOS, belongs on this list too. Returning everything to stock settings for a day is a free test, and it eliminates a cause that otherwise imitates all five of the above.
How to see the blue screen instead of an instant restart
If your PC restarts before you can read anything, Windows is doing it on purpose. Turning off the automatic restart leaves the blue screen and its stop code on screen until you reboot manually.
Press Windows + R, run sysdm.cpl, then Advanced → Startup and Recovery → Settings, and untick Automatically restart. The stop code on that screen — CRITICAL_PROCESS_DIED, WHEA_UNCORRECTABLE_ERROR and so on — narrows the search far more than Event 41 ever will.
Fast Startup muddies the log
With Fast Startup enabled, a normal shutdown is closer to a hibernation, so boot and shutdown events do not read the way you expect. If you are actively investigating restarts, turning it off in Power Options makes the log honest again — and on some machines it fixes the restarts outright.
When it is not the PC at all
Sometimes the log is clean because nothing on the PC did anything wrong. A brief dip in mains power is enough to reset a desktop, and it leaves exactly the same Event 41 behind as a hardware fault.
Worth ruling out before buying parts: other devices on the same circuit, a shared extension lead with a kettle or a heater on it, a power strip switch that is loose, and — for desktops in areas with unstable supply — the absence of a UPS. If the restarts correlate with the weather or with someone using the washing machine, the PC is the victim, not the cause.
If none of this matches what your log shows, the next step is reading the surrounding entries properly, which is covered in how to read Windows Event Viewer logs.