Windows Kernel event ID 41 error “The system has rebooted without cleanly shutting down first” in Windows

Windows Kernel event ID 41 error “The system has rebooted without cleanly shutting down first” in Windows

In Windows, your computer restarts, and a critical error message that resembles the following is recorded in the event log:

Event ID: 41

Description: The system has rebooted without cleanly shutting down first.

 Note The values for the Stop error BugcheckCode and the BugcheckParameters can vary.

More Information


The
kernel power event ID 41 error occurs when the computer is shut down,
or it restarts unexpectedly. When a computer that is running Windows
starts, a check is performed to determine whether the computer was shut
down cleanly. If the computer was not shut down cleanly, a Kernel Power
Event 41 message is generated.

An event 41 is used to report
that something unexpected happened that prevented Windows from shutting
down correctly. There may be insufficient information to explicitly
define what happened. To determine what may have happened and to
identify a potential resolution, it is important to know what the
computer was doing at the time just before the event occurred.

If
event 41 is logged because power to the computer was interrupted,
consider obtaining an uninterruptible power supply (UPS) such as a
battery backup power supply. An underpowered or failing power supply may
cause this behavior. For example, if you added RAM or additional
devices or hard disks when this problem began, the power supply may
cause the problem.

An event 41 can occur in the following scenarios.

Scenario 1: The computer restarts, and there is a Stop error BugcheckCode in the event data

When
a Stop error occurs, the Stop error data is written in Event ID 41 as
part of the additional event data. There may be the instances in which
the Stop error code information cannot be written before the computer
restarts or shuts down. Such instances are covered in scenario 3.

 Note
The BugcheckCode data in the event is written in decimal format instead
of a more typical hexadecimal format. Therefore, the decimal value
should be converted to a hexadecimal value.

If the Stop error
BugcheckCode entry in the event ID data is not zero, you should convert
the BugcheckCode value from decimal to hexadecimal. Most documentation
on Stop error codes reference the code as a hexadecimal value instead of
a decimal value. To do this, follow these steps:

  1. Click Start, and then type calc in the Search box.
  2. Click View, and then click Programmer.
  3. Make sure that the Dec option button is selected on the left side of calculator.
  4. Use the keyboard to enter the decimal value from the BugcheckCode value.
  5. Click the Hex option button on the left side of the calculator.

 Note The value that the calculator displays is now the hexadecimal code. Repeat these steps for other nonzero values.

The following example contains a Stop error BugcheckCode entry from an event ID 41:

EventData
BugcheckCode 159
BugcheckParameter1 0x3
BugcheckParameter2 0xfffffa80029c5060
BugcheckParameter3 0xfffff8000403d518
BugcheckParameter4 0xfffffa800208c010
SleepInProgress false
PowerButtonTimestamp 0Converts to 0x9f (0x3, 0xfffffa80029c5060, 0xfffff8000403d518, 0xfffffa800208c010)

 Note The
zeros that appear in front of the code are not typically displayed.
When a BugcheckCode entry is converted to a hexadecimal format, it
should have eight digits. For example, 0x9F is typically documented as
0x0000009f, and 0xA is documented as 0x0000000A. After you identify the
hexadecimal value, go to support.microsoft.com, and search for the
converted hexadecimal code (0x0000009f) and the word bugcheck.

For more information, see the following article on the Microsoft TechNet blog:

Scenario 2: The computer is shut down by pressing and holding the power button

The power button on the computer is pushed and held for at least four
seconds. This action is noted in the event data as a
PowerButtonTimestamp entry that has a value of something other than 0
(zero). There may be the instances where we cannot write the
PowerButtonTimestamp information before the computer restarts or shuts
down. Such instances are covered in scenario 3.

The preferred way to shut down Windows is to click Start,
and then click an option to turn off or shut down the computer. In this
case, the operating system closes all files and notifies all services
and applications that are running so that they can write any data to
disk and flush any caches.

If you have to press and hold the
power button because of an issue that limits the ability of the computer
to function correctly, you should run a query about the symptoms that
you are experiencing so that you can get help with troubleshooting.
Keywords that you might use in your search are “hang,” “responding,” or
“blank screen.”

For more information about a specific situation
in which a computer may stop responding, click the following article
number to view the article in the Microsoft Knowledge Base: 974476 The
computer stops responding when an USB device resumes from the USB
Selective Suspend state in Windows 7 or in Windows Server 2008 R2

Scenario
3: The system randomly restarts and no Stop error BugcheckCode is
listed, or the computer is completely unresponsive (hard hang)

The Stop error code and the PowerButtonTimestamp are listed as zero. For example, consider the following scenarios:

  • The
    Stop error BugcheckCode value is listed as zero. Circumstances can
    prevent writing the Stop error BugcheckCode information before the
    computer restarts or shuts down. In this case, a BugcheckCode value of
    zero is logged. Also, perhaps no Stop error occurred, and the shutdown
    resulted from a power loss. For example, on a portable computer, this
    could mean that the battery is removed or completely drained. Or, on a
    desktop computer, this could mean that the computer was unplugged, or a
    power outage occurred.
  • The PowerButtonTimestamp is listed as
    zero. Circumstances can prevent writing the PowerButtonTimestamp
    information before the computer restarts or shuts down. In this case, a
    value of zero is logged. This can occur if the power button is pressed
    and held for at least four seconds when Windows has an operation running
    that prevents writing the event to disk. You might also see this
    scenario if the computer is “hard-locked” and therefore unresponsive to
    any input, and the computer has to be powered off. To determine whether
    the computer is unresponsive, try pressing the CAPS LOCK key to toggle
    the CAPS light on the keyboard.

To check whether this scenario
is occurring, press the CAPS LOCK key on the keyboard. When you do
this, if the CAPS LOCK light on the keyboard does not change when you
press the CAPS LOCK key, the computer may be completely unresponsive
(hard hang).

This scenario usually indicates a problem with the hardware. To help isolate the problem, check the following items:

  1. Overclocking: Disable overclocking to see whether the issue occurs when the system is run at the correct speed.
  2. Check the memory:
    Verify the memory by using a memory checker. Verify that each memory
    chip is the same speed and that it is configured correctly in the
    system.
  3. Power supply: Make sure
    that the power supply has enough wattage to appropriately handle the
    installed devices. If you added memory, installed a newer processor,
    installed additional drives, or added external devices, such devices can
    require more energy than the current power supply can provide
    consistently.
  4. Overheating: Check whether the system is overheating by examining the internal temperature of the hardware.
  5. Defaults:
    Reset the system back to the system defaults to see whether the issues
    occur when the system is running in its default configuration.

If
you see that the computer generates a Stop error that contains a
BugcheckCode value that is not reported in an event ID 41, change the
restart behavior for the computer. To do this, follow these steps:

  1. Right-click My Computer, and then click Properties.
  2. Click Advanced system settings.
  3. Click the Advanced tab.
  4. In the Startup and Recovery section, click Settings.
  5. Click to clear the Automatically restart check box. 

Leave a Reply