Windows Kernel event ID 41 error "The system has rebooted without cleanly shutting down first" in Windows

In Windows, your computer restarts, and a critical error message that resembles the following is recorded in the event log:

Event ID: 41

Description: The system has rebooted without cleanly shutting down first.

 Note The values for the Stop error BugcheckCode and the BugcheckParameters can vary.

More Information

---

The kernel power event ID 41 error occurs when the computer is shut down, or it restarts unexpectedly. When a computer that is running Windows starts, a check is performed to determine whether the computer was shut down cleanly. If the computer was not shut down cleanly, a Kernel Power Event 41 message is generated.

An event 41 is used to report that something unexpected happened that prevented Windows from shutting down correctly. There may be insufficient information to explicitly define what happened. To determine what may have happened and to identify a potential resolution, it is important to know what the computer was doing at the time just before the event occurred.

If event 41 is logged because power to the computer was interrupted, consider obtaining an uninterruptible power supply (UPS) such as a battery backup power supply. An underpowered or failing power supply may cause this behavior. For example, if you added RAM or additional devices or hard disks when this problem began, the power supply may cause the problem.


An event 41 can occur in the following scenarios.

Scenario 1: The computer restarts, and there is a Stop error BugcheckCode in the event data

When a Stop error occurs, the Stop error data is written in Event ID 41 as part of the additional event data. There may be the instances in which the Stop error code information cannot be written before the computer restarts or shuts down. Such instances are covered in scenario 3.

 Note The BugcheckCode data in the event is written in decimal format instead of a more typical hexadecimal format. Therefore, the decimal value should be converted to a hexadecimal value.

If the Stop error BugcheckCode entry in the event ID data is not zero, you should convert the BugcheckCode value from decimal to hexadecimal. Most documentation on Stop error codes reference the code as a hexadecimal value instead of a decimal value. To do this, follow these steps:

1. Click Start, and then type calc in the Search box.
2. Click View, and then click Programmer.
3. Make sure that the Dec option button is selected on the left side of calculator.
4. Use the keyboard to enter the decimal value from the BugcheckCode value.
5. Click the Hex option button on the left side of the calculator.

 Note The value that the calculator displays is now the hexadecimal code. Repeat these steps for other nonzero values.

The following example contains a Stop error BugcheckCode entry from an event ID 41:

EventData
BugcheckCode 159
BugcheckParameter1 0x3
BugcheckParameter2 0xfffffa80029c5060
BugcheckParameter3 0xfffff8000403d518
BugcheckParameter4 0xfffffa800208c010
SleepInProgress false
PowerButtonTimestamp 0Converts to 0x9f (0x3, 0xfffffa80029c5060, 0xfffff8000403d518, 0xfffffa800208c010)

 Note The zeros that appear in front of the code are not typically displayed. When a BugcheckCode entry is converted to a hexadecimal format, it should have eight digits. For example, 0x9F is typically documented as 0x0000009f, and 0xA is documented as 0x0000000A. After you identify the hexadecimal value, go to support.microsoft.com, and search for the converted hexadecimal code (0x0000009f) and the word bugcheck.

For more information, see the following article on the Microsoft TechNet blog:

How to Debug Kernel Mode Blue Screen Crashes (for beginners)

Scenario 2: The computer is shut down by pressing and holding the power button

The power button on the computer is pushed and held for at least four seconds. This action is noted in the event data as a PowerButtonTimestamp entry that has a value of something other than 0 (zero). There may be the instances where we cannot write the PowerButtonTimestamp information before the computer restarts or shuts down. Such instances are covered in scenario 3.

The preferred way to shut down Windows is to click Start, and then click an option to turn off or shut down the computer. In this case, the operating system closes all files and notifies all services and applications that are running so that they can write any data to disk and flush any caches.

If you have to press and hold the power button because of an issue that limits the ability of the computer to function correctly, you should run a query about the symptoms that you are experiencing so that you can get help with troubleshooting. Keywords that you might use in your search are "hang," "responding," or "blank screen."

For more information about a specific situation in which a computer may stop responding, click the following article number to view the article in the Microsoft Knowledge Base: 974476 The computer stops responding when an USB device resumes from the USB Selective Suspend state in Windows 7 or in Windows Server 2008 R2

Scenario 3: The system randomly restarts and no Stop error BugcheckCode is listed, or the computer is completely unresponsive (hard hang)

The Stop error code and the PowerButtonTimestamp are listed as zero. For example, consider the following scenarios:

• The Stop error BugcheckCode value is listed as zero. Circumstances can prevent writing the Stop error BugcheckCode information before the computer restarts or shuts down. In this case, a BugcheckCode value of zero is logged. Also, perhaps no Stop error occurred, and the shutdown resulted from a power loss. For example, on a portable computer, this could mean that the battery is removed or completely drained. Or, on a desktop computer, this could mean that the computer was unplugged, or a power outage occurred.
• The PowerButtonTimestamp is listed as zero. Circumstances can prevent writing the PowerButtonTimestamp information before the computer restarts or shuts down. In this case, a value of zero is logged. This can occur if the power button is pressed and held for at least four seconds when Windows has an operation running that prevents writing the event to disk. You might also see this scenario if the computer is “hard-locked” and therefore unresponsive to any input, and the computer has to be powered off. To determine whether the computer is unresponsive, try pressing the CAPS LOCK key to toggle the CAPS light on the keyboard.

To check whether this scenario is occurring, press the CAPS LOCK key on the keyboard. When you do this, if the CAPS LOCK light on the keyboard does not change when you press the CAPS LOCK key, the computer may be completely unresponsive (hard hang).

This scenario usually indicates a problem with the hardware. To help isolate the problem, check the following items:

1. Overclocking: Disable overclocking to see whether the issue occurs when the system is run at the correct speed.
2. Check the memory: Verify the memory by using a memory checker. Verify that each memory chip is the same speed and that it is configured correctly in the system.
3. Power supply: Make sure that the power supply has enough wattage to appropriately handle the installed devices. If you added memory, installed a newer processor, installed additional drives, or added external devices, such devices can require more energy than the current power supply can provide consistently.
4. Overheating: Check whether the system is overheating by examining the internal temperature of the hardware.
5. Defaults: Reset the system back to the system defaults to see whether the issues occur when the system is running in its default configuration.

If you see that the computer generates a Stop error that contains a BugcheckCode value that is not reported in an event ID 41, change the restart behavior for the computer. To do this, follow these steps:

1. Right-click My Computer, and then click Properties.
2. Click Advanced system settings.
3. Click the Advanced tab.
4. In the Startup and Recovery section, click Settings.
5. Click to clear the Automatically restart check box.