01Fields in the event
The cited Microsoft page does not list field names for this event.
02How to use it
Pair each 6006 with the following 6005 to measure downtime. A boot without a preceding 6006 points to an unclean shutdown (see 6008 and 41).
03Caveats
The cited page gives one sentence and no message text, source or recording conditions. It does not show who requested the shutdown; use 1074 for that.
05Sources
- Microsoft Learn — Advanced troubleshooting for Event ID 41 checked 2026-10-18