Troubleshooting Windows Unexpected Restarts and BSOD’s

Your computer restarts, and a critical error message is logged in the event log:

Log Name: System
Source: Microsoft-Windows-Kernel-Power
Event ID: 41
Level: Critical
Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

The Details tab shows the following information:

EventData
BugcheckCode 0
BugcheckParameter1 0x0
BugcheckParameter2 0x0
BugcheckParameter3 0x0
BugcheckParameter4 0x0
SleepInProgress true
PowerButtonTimestamp 129165039139928187

Note The values for the Stop error BugcheckCode and the BugcheckParameters can vary.

Back to the top

CAUSE

The kernel power Event ID: 41 error is generated under different scenarios where the computer is shut down or restarts unexpectedly. When the computer that is running Windows is started, a check is performed to determine whether the computer was cleanly shut down. If the computer was not shut down correctly, a Kernel Power Event 41 message is generated. In the following three scenarios, an Event 41 may be generated.

Scenario 1

A Stop error occurs and the computer restarts. When a Stop error occurs, the Stop error data is written in Event ID 41 as part of the additional event data. There may be the instances in which the Stop error code information cannot be written before the computer restarts or shuts down. Such instances are covered in scenario 3.
Note The BugcheckCode data in the event is written in decimal format instead of in more typical hexadecimal format. Therefore, the decimal value should be converted to a hexadecimal value. This is more fully discussed in the “Resolution” section. 

Scenario 2

The power button on the computer is pushed and held for at least four seconds. This action is noted in the event data as a PowerButtonTimestamp entry that has a value of something other than 0 (zero). There may be the instances where we cannot write the PowerButtonTimestamp information before the computer restarts or shuts down. Such instances are covered in scenario 3.

Scenario 3

The Stop error code and the PowerButtonTimestamp are listed as zero. For example, consider the following scenarios:

• The Stop error BugcheckCode value is listed as zero. Circumstances can prevent writing the Stop error BugcheckCode information before the computer restarts or shuts down. In this case, a BugcheckCode value of zero is logged. Also, perhaps no Stop error occurred, and the shutdown resulted from a power loss. For example, on a portable computer, this could mean that the battery is removed or completely drained. Or, on a desktop computer, this could mean that the computer was unplugged, or a power outage occurred.
• The PowerButtonTimestamp is listed as zero. Circumstances can prevent writing the PowerButtonTimestamp information before the computer restarts or shuts down. In this case, a value of zero is logged. This can occur if the power button is pressed and held for at least four seconds when Windows has an operation running that prevents writing the event to disk. You could also see this scenario if the computer was “Hard-locked” and therefore unresponsive to any input, and the computer had to be powered off. To determine whether the computer is unresponsive, you might try to press the CAPS LOCK key to toggle the CAPS light on the keyboard.

Back to the top

RESOLUTION

An event 41 is used to report that something unexpected happened that prevents Windows from shutting down correctly. Therefore, there may not always be enough information to explicitly define what happened. To determine what may have happened and to identify a potential resolution, it is important to know what the computer was doing at the time just before the event occurred.
If event 41 is logged because power to the computer was interrupted, you may want to consider obtaining an uninterruptible power supply (UPS) such as a battery backup power supply. Maybe an underpowered or failing power supply caused this behavior. For example, if you added RAM or additional devices or hard disks when this problem began, the power supply may be a cause of the problem.

Scenario 1: The computer restarted, and there is a Stop error BugcheckCode in the event data

If the Stop error BugcheckCode entry in the event ID data is not zero, you should convert the BugcheckCode value from decimal to hexadecimal. Most documentation on Stop error codes reference the code as a hexadecimal value instead of a decimal value. To do this, follow these steps:

1. Click Start, and then type calc in the Search box.
2. Click View, and then click Programmer.
3. Make sure that the Dec option button is selected on the left side of calculator.
4. Use the keyboard to enter the decimal value from the BugcheckCode value.
5. Click the Hex option button on the left side of the calculator.

Note The value that the calculator displays is now the hexadecimal code. Repeat these steps for other nonzero values.
The following example contains a Stop error BugcheckCode entry from an event ID 41:

EventData
  BugcheckCode 159
BugcheckParameter1 0x3
  BugcheckParameter2 0xfffffa80029c5060 
  BugcheckParameter3 0xfffff8000403d518
  BugcheckParameter4 0xfffffa800208c010
SleepInProgress false
PowerButtonTimestamp 0

Converts to 0x9f (0x3, 0xfffffa80029c5060, 0xfffff8000403d518, 0xfffffa800208c010)
Note The zeros that come in front of the code are not typically displayed. When a BugcheckCode entry is converted to a hexadecimal format, it should have eight digits. For example, 0x9F is typically documented as 0x0000009f, and 0xA is documented as 0x0000000A. After you identify the hexadecimal value, visit support.microsoft.com, and search for the converted hexadecimal code (0x0000009f) and the word bugcheck.
For more information about "How to debug kernel mode blue screen crashes (for beginners)," visit the following TechNet blog:

http://blogs.technet.com/askcore/archive/2008/11/01/how-to-debug-kernel-mode-blue-screen-crashes-for-beginners.aspx

Scenario 2: Shut down the computer by pressing and holding the power button

If there is a choice, the preferred way to shut down Windows is to click Start and then to click an option to turn off or shut down the computer. In this case, the operating system closes all files and notifies all services and applications that are running so that they can write any data to disk and flush any caches.
If you have to press and hold the power button to get past an issue that is limiting the ability of the computer to function as expected, you should run a query about the symptoms that you are experiencing so that you can get help with troubleshooting. Some keywords that you might use in your search are “hang,” “responding,” or perhaps “blank screen.”
For more information about a specific situation in which a computer may stop responding, click the following article number to view the article i
n the Microsoft Knowledge Base:

974476   The computer stops responding when an USB device resumes from the USB Selective Suspend state in Windows 7 or in Windows Server 2008 R2

You can also visit the Windows 7 Solution Center for troubleshooting help. To do this, visit the following Microsoft website:

http://support.microsoft.com/ph/14019#tab6

Scenario 3: The system randomly restarts and no Stop error BugcheckCode is listed, or the computer is completely unresponsive (hard hang)

To check whether this scenario is occurring, press the CAPS LOCK key on the keyboard. When you do this, if the CAPS LOCK light on the keyboard does not change when you press the CAPS LOCK key, the computer may be completely unresponsive (hard hang).
This scenario usually indicates a problem with the hardware. Another possibility is that a driver may cause this problem. To help isolate the problem, check the following items:

1. Overclocking: Disable overclocking and see whether the issue happens when the system is run at the correct speed.
2. Check the memory: Verify the memory by using a memory checker. Verify that each memory chip is the same speed and that it is configured correctly in the system.
3. Power Supply: Make sure that the power supply has enough wattage to appropriately handle the installed devices. If you added memory, installed a newer processor, installed additional drives, or added external devices, such devices may require more energy than the current power supply can provide consistently.
4. Overheating: Check whether the system is overheating by examining the internal temperature of the hardware.
5. Defaults: Use system defaults, and run the system.

If you see that the computer generates a Stop error that contains a BugcheckCode value that is not reported in an event ID 41, modify the restart behavior for the computer. To do this, follow these steps:

1. Right-click My Computer, and then click Properties.
2. Click Advanced system settings.
3. Click the Advanced tab.
4. In the Startup and Recovery section, click Settings.
5. Click to clear the Automatically restart check box.

Back to the top

---

APPLIES TO

• Windows 7 Enterprise
• Windows 7 Professional
• Windows 7 Ultimate
• Windows Web Server 2008 R2
• Windows Server 2008 R2 Foundation
• Windows Server 2008 R2 Standard
• Windows Server 2008 R2 Enterprise
• Windows Server 2008 R2 Datacenter
• Microsoft Hyper-V Server 2008 R2
• Windows HPC Server 2008 R2

Reference: Windows Kernel event ID 41 error in Windows 7 or in Windows Server 2008 R2: “The system has rebooted without cleanly shutting down first”