Random Restarts With No Blue Screen — How to Find the Real Cause in Event Viewer

29 Jul 2026

A Windows 11 computer suddenly goes black, restarts and returns to the sign-in screen as though nothing happened.

There is no blue screen, no useful error message and often no warning. You may be working in Microsoft 365, joining a Teams call, playing a game or leaving the computer idle when it unexpectedly reboots.

Windows Event Viewer may then show a critical Kernel-Power Event ID 41. That sounds like a diagnosis, but it is not.

Event ID 41 only confirms that Windows restarted without completing a normal shutdown. It does not automatically prove that the power supply is faulty, and it does not identify the component responsible. Microsoft’s current guidance explains that the event can follow a power interruption, a system crash, a freeze or another condition that stopped Windows shutting down correctly.

To find the real cause, you need to examine the events surrounding the restart, check whether Windows recorded a hidden Stop error and compare the evidence with what the computer was doing at the time.

Why Can a Computer Restart Without Showing a Blue Screen?

A blue screen may have occurred too quickly to see.

By default, Windows can restart automatically after a serious system error. The display may go black and the machine may reboot before you have time to read the Stop code.

Other restarts happen without a conventional blue screen because the computer:

Lost electrical power
Froze and was automatically reset
Overheated
Experienced unstable memory or processor behaviour
Encountered a motherboard or power-delivery fault
Suffered a graphics-driver or hardware failure
Restarted after a firmware problem
Was reset by watchdog or management software
Failed while creating the crash-dump file

The lack of a visible blue screen therefore does not rule out a Windows crash.

Start by Recording What Happened

Intermittent restarts are much easier to diagnose when you record the circumstances.

Note:

The exact time of the restart
What applications were open
Whether the computer was under heavy load
Whether it had just woken from sleep
Whether a USB device or dock had been connected
Whether Windows or a driver had recently updated
Whether the fans became unusually loud
Whether the screen froze before going black
Whether the computer powered off or restarted immediately
Whether lights and fans remained on
Whether the problem occurs on battery, mains power or both

The timestamp is especially important because Event Viewer contains thousands of entries. Knowing when the restart occurred lets you focus on the relevant minute rather than searching the entire log.

How to Open Event Viewer

Right-click the Start button and select:

Event Viewer

Alternatively, press Windows key + R, enter:

eventvwr.msc

Then press Enter.

Expand:

Windows Logs > System

The System log contains events relating to drivers, hardware, power management, Windows services and startup.

Filter the System Log

Rather than scrolling through every event:

Select System.
Choose Filter Current Log from the right-hand panel.
Tick Critical, Error and Warning.
Enter relevant event IDs if required.
Select OK.

Useful event IDs to investigate include:

41 — Kernel-Power
6008 — Previous shutdown was unexpected
1001 — Bugcheck or Windows Error Reporting
WHEA-Logger events — Hardware errors
1074 — A process or user intentionally requested a restart
6005 — Event Log service started
6006 — Event Log service stopped normally
161 or 162 from volmgr — Problems creating a crash dump

Do not assume every warning near the restart caused it. Windows logs many routine warnings that are unrelated to the failure.

The most useful evidence is usually found immediately before the Kernel-Power event.

Understanding Kernel-Power Event ID 41

A typical Event ID 41 message says:

The system has rebooted without cleanly shutting down first.

This means that after Windows started again, it detected that the previous session had not ended normally.

Possible explanations include:

The power cable was disconnected
The power supply stopped delivering stable power
The battery failed
The computer froze
Windows encountered a Stop error
The reset button was pressed
The power button was held down
The motherboard reset the system
A thermal or electrical protection mechanism intervened

Event ID 41 records the result of the failure, not necessarily its original cause.

Treat it as a starting point.

Check the BugcheckCode Inside Event ID 41

Double-click the Kernel-Power Event ID 41 entry and open the Details tab.

Select Friendly View or XML View and look for:

BugcheckCode

If BugcheckCode Is Not Zero

A non-zero value indicates that Windows recorded a Stop error.

The code may be shown as a decimal number rather than the familiar hexadecimal blue-screen code.

For example, decimal 159 converts to hexadecimal 9F, corresponding to:

0x0000009F

You can convert it using Windows Calculator:

Open Calculator.
Select Programmer mode.
Choose DEC.
Enter the decimal BugcheckCode.
Read the equivalent HEX value.

A non-zero code means the restart was probably caused by a Windows crash, even if you never saw the blue screen.

If BugcheckCode Is Zero

A zero value means Windows did not capture a usable Stop code.

That can happen when:

Power disappeared too quickly
The system froze completely
The motherboard reset the machine
The crash occurred before Windows could record it
The dump process failed
The system lost access to its storage drive

This makes power, hardware stability, firmware and dump-configuration checks more important.

Look for Event ID 1001

Search the System log for Event ID 1001 around the same time.

The source may appear as:

BugCheck
Windows Error Reporting
WER-SystemErrorReporting

A BugCheck event can include:

The Stop code
Bugcheck parameters
The crash-dump location
A report identifier

If Event ID 1001 exists, the restart was caused by a recorded Windows Stop error rather than a simple loss of power.

The event may point to a file such as:

C:\Windows\MEMORY.DMP

or a minidump under:

C:\Windows\Minidump

The dump file normally provides much more useful evidence than Event ID 41 alone.

What Does Event ID 6008 Mean?

Event ID 6008 usually states that the previous system shutdown was unexpected.

Like Event ID 41, it confirms that Windows did not shut down normally.

It does not explain whether the cause was:

A crash
A freeze
Power loss
Overheating
A forced shutdown
Hardware instability

Use it to confirm the timing of the incident, but do not treat it as the root cause.

Check for Event ID 1074

Event ID 1074 is useful because it shows when a program, Windows component or user deliberately initiated a restart.

It may name:

Windows Update
An installer
A management agent
A user account
A shutdown command
A remote-management tool

If Event ID 1074 appears shortly before the reboot, the restart may have been intentional rather than a crash.

This is particularly relevant on business computers where updates, security software or IT management tools can schedule restarts.

Look for WHEA-Logger Events

WHEA stands for Windows Hardware Error Architecture.

Windows uses WHEA to record hardware errors reported by processors, memory controllers, PCI Express devices and other platform components. These events are written into the System log.

Filter the log by source:

WHEA-Logger

A WHEA event close to the restart can indicate a lower-level stability problem involving:

CPU
RAM or memory controller
Motherboard
PCI Express
Graphics card
NVMe storage
Firmware
Voltage or power delivery
Overclocking or undervolting

The event description may include terms such as:

Machine Check Exception
Cache Hierarchy Error
Memory Error
Bus/Interconnect Error
PCI Express Root Port
Processor Core
Corrected Hardware Error
Fatal Hardware Error

A corrected WHEA warning does not always cause a restart. However, repeated corrected errors followed by a fatal error or Kernel-Power event deserve investigation.

Corrected Versus Fatal Hardware Errors

A corrected hardware error means the platform detected a problem and recovered from it.

A fatal or uncorrected hardware error means the system could not safely continue.

Repeated corrected events may still indicate:

Marginal memory stability
A failing PCI Express device
Poor motherboard firmware
An unstable overclock
An NVMe or graphics-card problem
Signal or power-delivery instability

Do not ignore hundreds of repeated corrected errors simply because the computer has not yet crashed.

Check Events Immediately Before the Restart

The event directly before Event ID 41 is often more useful than the Event ID 41 entry itself.

Look for errors involving:

Display drivers
Disk or storage controllers
NVMe devices
ACPI
Thermal management
USB controllers
Network adapters
Kernel-PnP
Driver frameworks
WHEA-Logger
Volume Manager
Service failures

However, be careful with timing.

Some events are written after the computer restarts and describe consequences rather than causes. Concentrate on events whose timestamps occur before the system went down.

Graphics Driver and GPU Clues

A graphics-related failure may show symptoms such as:

The display going black while audio continues
Fans suddenly speeding up
The machine restarting during gaming or rendering
The problem occurring when connecting a monitor
A display-driver recovery event before the restart

Look for messages from sources such as:

Display
nvlddmkm
amdkmdag
amdwddmg
igfx
Intel graphics components

A graphics-driver error does not automatically prove the graphics card is defective. Possible causes include:

Driver corruption
GPU overheating
Power-supply instability
An unstable GPU overclock
Faulty video memory
PCI Express problems
Dock or display compatibility
Firmware issues

Start by updating or cleanly reinstalling the approved graphics driver.

Storage and NVMe Clues

If Windows loses access to the system drive, it may freeze or restart before it can save a crash dump.

Look for events involving:

Disk
stornvme
storahci
StorPort
NTFS
volmgr
iaStor
Controller resets
Bad blocks
Timeout or reset messages

Possible causes include:

Failing SSD
Outdated SSD firmware
Faulty storage controller
Loose cable
Overheating NVMe drive
Motherboard slot problem
Power-management issue

Back up important data immediately when storage errors appear.

What Volmgr Events Mean

The volmgr source manages volume and dump-related operations.

Events such as 161 or 162 may indicate that Windows could not create a crash-dump file.

This can happen because:

The page file is disabled
The page file is too small
The system drive lacks free space
Windows lost access to the drive
The storage system failed during the crash
The dump configuration is incorrect

A failed dump does not tell you what caused the crash, but it explains why no useful minidump is available.

Configure Windows to Show the Blue Screen

To stop Windows restarting before you can read the error:

Search for View advanced system settings.
Open the Advanced tab.
Under Startup and Recovery, select Settings.
Untick Automatically restart.
Make sure Write debugging information is enabled.
Select OK.

On the next Stop error, Windows should remain on the blue screen long enough for you to record the code.

This will not prevent sudden power-loss restarts because Windows has no opportunity to display anything when power disappears.

Check the Crash-Dump Configuration

In Startup and Recovery, review Write debugging information.

Suitable options include:

Automatic memory dump
Kernel memory dump
Small memory dump

For many systems, Automatic memory dump is a sensible starting point.

Also ensure:

A page file exists on the Windows drive
The system drive has adequate free space
The dump path is valid
Storage errors are not preventing the dump from being written

Avoid manually disabling the page file as a performance “tweak”. It can prevent useful crash data from being saved and can cause problems for some applications.

Check Reliability Monitor

Reliability Monitor presents crashes, update failures and application problems on a timeline that is often easier to read than Event Viewer.

Search the Start menu for:

View reliability history

Look for a red cross on the date and time of the restart.

Select it to review entries such as:

Windows stopped working
Hardware error
Windows was not properly shut down
Driver failure
Application crash
Update installation

Reliability Monitor may provide a technical-details link containing a Stop code, fault bucket or hardware error identifier.

Use it alongside Event Viewer rather than as a replacement.

Compare the Restart With Windows Update History

Open:

Settings > Windows Update > Update history

Check whether the restart began after:

A cumulative Windows update
A graphics-driver update
A chipset update
A firmware update
A BIOS update
A device-driver installation

Timing alone does not prove causation, but it helps prioritise testing.

Where the issue started immediately after a driver update, try:

Installing a newer corrected driver
Rolling back to the previous approved version
Using the computer manufacturer’s driver
Performing a clean driver installation

Do not permanently remove security updates without assessing the risk.

Check Device Manager

Right-click Start and select Device Manager.

Look for:

Yellow warning symbols
Unknown devices
Disabled devices
Recently installed hardware
Duplicate devices
Devices repeatedly disappearing and returning

Pay particular attention to:

Display adapters
Storage controllers
System devices
Network adapters
Universal Serial Bus controllers
Sound, video and game controllers

A warning symbol may identify a driver or hardware problem, although many intermittent faults do not leave a permanent warning.

Power Supply and Power-Delivery Problems

On desktop computers, an unstable or failing power supply can cause instant restarts without a blue screen.

The problem may become more likely when:

Gaming
Rendering
Starting a demanding application
The graphics card boosts to a higher power level
Multiple USB devices are connected
The room becomes warm
The computer has recently been upgraded

Possible causes include:

Undersized power supply
Ageing components
Loose power cables
Faulty extension leads
Damaged wall socket
Graphics power connectors not seated correctly
Incorrect modular power-supply cables
Transient power spikes
Motherboard power-delivery faults

Kernel-Power Event 41 alone does not prove the PSU is faulty. Physical inspection and controlled hardware testing are required.

Never open a power-supply unit. Dangerous voltages can remain inside even when it is disconnected.

Laptop Power Problems

On laptops, unexpected restarts may involve:

Battery failure
Faulty charger
Damaged charging port
Docking station
USB-C power-delivery negotiation
Overheating
Firmware
Motherboard power circuitry

Test whether the restart occurs:

On battery only
With the charger connected
Through a dock
Using the manufacturer’s original charger
After waking from sleep
At a particular battery percentage

Avoid using an underpowered or unapproved USB-C charger.

Check Temperatures

A system may restart to protect itself when temperatures become unsafe.

Monitor:

CPU temperature
GPU temperature
GPU hotspot temperature
SSD temperature
Fan speed
Clock speeds
Power consumption

Warning signs include:

Fans running at full speed
The case becoming unusually hot
Restarts during demanding tasks
Reduced performance before the restart
Dust-blocked vents
A failed fan
A laptop used on a soft surface

Use the hardware manufacturer’s diagnostic software or a reputable monitoring utility.

Do not rely on a temperature recorded after the computer has restarted. Components can cool quickly.

Remove Overclocks and Undervolts

A system can appear stable for months and then begin restarting after a Windows, BIOS or workload change.

Return these settings to their defaults:

CPU overclock
GPU overclock
GPU memory overclock
CPU undervolt
GPU undervolt
Precision Boost Overdrive
Automatic motherboard enhancement
XMP or EXPO memory profile

Even factory-supported memory profiles are technically overclocked beyond the memory module’s base specification.

If the restarts stop at default settings, reintroduce changes gradually.

Test the Memory

Unstable or failing memory can cause:

Restarts
Freezes
Blue screens
Application crashes
File corruption
WHEA events
Driver errors

Run Windows Memory Diagnostic as an initial test:

Search for Windows Memory Diagnostic.
Choose Restart now and check for problems.
Allow the test to finish.

For intermittent faults, a longer specialist memory test may be required.

Also test with XMP or EXPO disabled. If the problem only appears with the memory profile enabled, the issue may involve RAM compatibility, BIOS settings or the processor’s memory controller.

Update BIOS and Firmware Carefully

Check the computer or motherboard manufacturer’s support page for updates relating to:

BIOS or UEFI
Chipset
Intel Management Engine
AMD platform components
SSD firmware
Dock firmware
Thunderbolt
Graphics
Power management

Read the release notes and use only files intended for the exact model.

Before updating the BIOS:

Back up important data.
Ensure the BitLocker recovery key is available.
Record important BIOS settings.
Connect laptops to reliable mains power.
Do not interrupt the update.

A BIOS update may reset memory profiles, Secure Boot, virtualisation and fan settings.

Run Manufacturer Hardware Diagnostics

Many business computers include built-in diagnostics accessible during startup or through a support application.

These may test:

Processor
Memory
SSD
Battery
Fans
Motherboard
Power adapter
Graphics
Sensors

A passed short test does not completely rule out an intermittent fault, but a failed test provides useful evidence for repair or warranty support.

Record any error or validation code.

Run Windows System Repairs

Open Terminal as Administrator and run:

DISM.exe /Online /Cleanup-Image /RestoreHealth

When that completes, run:

sfc /scannow

Restart the computer afterwards.

These commands can repair damaged Windows components and protected system files. They will not fix a failing power supply, unstable RAM or overheating hardware.

Perform a Clean Boot

A clean boot starts Windows with a reduced set of third-party services and startup programs.

This can identify conflicts involving:

Security software
Hardware-monitoring utilities
RGB applications
VPN software
Audio enhancements
Peripheral control software
Backup agents
Manufacturer utilities

Use System Configuration to hide Microsoft services before disabling third-party entries.

If the restarts stop during a clean boot, restore services in groups until the problem returns.

Do not leave business-security software disabled after testing.

Test Without Unnecessary Peripherals

Disconnect non-essential devices such as:

USB hubs
External drives
Webcams
Capture devices
Printers
Audio interfaces
Controllers
Docks
Additional monitors

A defective USB device, dock, cable or power-hungry accessory can destabilise the system.

Reconnect devices individually after the computer has been stable long enough to provide a meaningful comparison.

Look for a Pattern

The circumstances of the restart can point towards the likely cause.

Restarts during gaming or rendering

More likely possibilities include:

GPU driver
Graphics card
Power supply
GPU temperature
CPU temperature
Unstable overclock
Memory instability

Restarts while idle or sleeping

Consider:

Power-state transitions
BIOS or chipset firmware
Network or storage power management
Connected standby
Undervolting
Scheduled maintenance
Wake-related drivers

Restarts when plugging in a dock or USB device

Investigate:

Dock firmware
USB controller
Power delivery
Device driver
Damaged cable
External display
Charger capacity

Restarts during Windows startup

Consider:

Storage
Boot drivers
Firmware
Corrupted Windows files
Security software
Recent updates
Hardware initialisation

Restarts at random under every workload

Possible causes include:

RAM
Motherboard
PSU
Battery
Firmware
Storage
CPU instability

Patterns do not prove the cause, but they help determine which tests should come first.

Do Not Chase Every Error in Event Viewer

A healthy Windows computer can contain many warnings and errors.

Common entries may relate to:

Services starting late
Applications not responding
Network availability
DistributedCOM
Device discovery
Temporary update failures

The presence of a red error icon does not mean that event caused the restart.

Prioritise events that:

Occurred immediately before the restart
Repeat each time the failure occurs
Mention hardware, storage, display or bugcheck data
Match the observed symptoms
Began after a specific change

Correlation across several incidents is much stronger evidence than a single isolated warning.

Create a Custom View for Unexpected Restarts

For repeated problems, create a focused Event Viewer view.

Open Event Viewer.
Select Custom Views.
Choose Create Custom View.
Select Critical, Error and Warning.
Choose System under Event logs.
Enter relevant IDs such as:

41,6008,1001,1074

Save the view with a name such as:

Unexpected Restarts

You can also create a separate view filtered by the WHEA-Logger source.

This makes it easier to compare future incidents.

Export the Relevant Events

When asking for technical support, export the original event data rather than relying only on screenshots.

In Event Viewer:

Select the relevant event or filtered log.
Choose Save Selected Events or Save All Events in Custom View As.
Save the file in .evtx format.

Also record:

Restart time
Computer model
Windows version
BIOS version
Recent hardware changes
Recent updates
What the user was doing
Whether a dump file exists

An exported log preserves details that may not appear in the General tab.

When to Stop Using the Computer

Stop and arrange professional diagnosis when:

You smell burning or hot electronics
The power connector sparks
The battery is swollen
The system repeatedly overheats
The storage drive reports serious errors
Files are becoming corrupted
The machine restarts every few minutes
WHEA reports repeated fatal hardware errors
The computer is business-critical
Important data is not backed up

Continuing to use failing hardware can cause data loss or additional damage.

The Best Troubleshooting Order

Work through the investigation in this order:

Record the exact restart time and what the computer was doing.
Open Event Viewer > Windows Logs > System.
Find Kernel-Power Event ID 41.
Check its BugcheckCode.
Look for Event ID 1001 and a dump-file path.
Check Event ID 6008 to confirm the timing.
Look for Event ID 1074 to rule out an intentional restart.
Review events immediately before the shutdown.
Filter for WHEA-Logger hardware events.
Check for storage, display and volmgr errors.
Disable automatic restart so the next blue screen remains visible.
Confirm that crash dumps and the page file are configured.
Check Reliability Monitor.
Review Windows, driver and firmware update history.
Return overclocks, undervolts and memory profiles to defaults.
Check temperatures and power delivery.
Run memory, storage and manufacturer diagnostics.
Update approved drivers, BIOS and firmware.
Test a clean boot and disconnect unnecessary peripherals.
Arrange hardware testing if the evidence remains inconclusive.

How Hamilton Group Can Help

Random restarts are difficult to diagnose because the visible symptom may be several steps removed from the original fault.

A Kernel-Power event could point towards power loss, but the real cause may be unstable memory, a graphics failure, overheating, storage timeouts, firmware or a hidden Windows Stop error.

Hamilton Group can help with:

Event Viewer and crash-log analysis
Windows memory-dump investigation
Kernel-Power Event ID 41 faults
WHEA hardware errors
Driver and firmware problems
BIOS and chipset updates
Memory and storage testing
Overheating and power diagnostics
Laptop, desktop and docking-station faults
Microsoft Intune and managed-device issues
Business backup and recovery

We can correlate the event logs, crash dumps and hardware symptoms to identify the real cause rather than replacing parts at random.

Find the Cause Before the Next Restart

Event Viewer may not hand you the answer in one line, but it can show whether the restart followed a hidden blue screen, a deliberate shutdown, a hardware error or a sudden loss of power.

The most important point is not to treat Kernel-Power Event ID 41 as the diagnosis. It is evidence that Windows did not shut down correctly. The events and system behaviour immediately before it are what lead you towards the cause.

For help diagnosing unexplained Windows restarts, hardware instability or recurring business-computer faults, call Hamilton Group on 0330 043 0069 or book a call with one of our experts today.

Previous Next