The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 4,224 other subscribers

Searching for Windows shutdown messages in the event log

Posted by jpluimers on 2018/02/21

Searching for shutdown isn’t enough as frequent WAS messages also contain that search string.

Searching for shutdown of will work as they match both these:

The process C:\Windows\system32\shutdown.exe (COMPUTERNAME) has initiated the shutdown of computer COMPUTERNAME on behalf of user COUNTERS\Administrator for the following reason: No title for this reason could be found
Reason Code: 0x800000ff
Shutdown Type: shutdown


The reason supplied by user DOMAIN\Username for the last unexpected shutdown of this computer is: Other (Unplanned)
Reason Code: 0xa000000
Problem ID: ######
Bugcheck String:
Comment: VM host failure


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: