Update 2: Tracking the reasons for a few shutdowns in the past couple of weeks, using the Event Viewer without filtering events, to get to the approximate time of shutdown, it seems like the last few shutdowns were caused by system overheating, and not by some malicious script or process.
I will continue to monitor that and update this question if new findings are observed.
Update 1: I used Sysinteranls Autoruns utility as suggested by @Mark, and listed all the (non-Microsoft) startup objects, to look for a script that supposedly calls Shutdown
. After exporting and cleaning the list of the known binary file types (.exe
, .sys
, .dll
) I saw two proprietary binary files belonging to a specific application which I installed some time ago. The computer was problematic long before I installed that app, so I do not think those are related to the problem, but I uninstalled it anyway. Other than the binaries and a few File not found
entries, there are no other entries in the list.
Is there a way to log what application called the shutdown.exe
utility?
Original question: My Dell E7450 Win10 laptop regularly shuts itself down spontaneously. Looking online, I found a couple of resources pointing to the Event Viewer application.
Following the instructions, I am able to see the list of shutdown events (codes 1074, 6006, 6008). It seems like no 6006 and 6008 events are recorded. Of the multiple 1074 events, I see a few that are related to the software updates, but many that are related to the spontaneous shutdowns.
Examining the event(s), they all look like the following. The reason code is 0x800000ff
and no reason nor comment are provided.
I can normally immediately turn the computer on again, and log into Windows.
Upon these shutdowns, the work is not properly saved, if not by the auto-save features of the various running apps (if they have ones). With Chrome, I sometimes get the "Restore previous session" popup, and sometimes have to go through the History menu to reopen the previous Chrome windows.
How can I determine the reason for those shutdowns?
c:\windows\system32\shutdown.exe
(to Shutdown1 perhaps). If an elevated command prompt typetakeown /f shutdown.exe /a
thencacls shutdown.exe /g administrators:F
thenren shutdown.exe shutdown1.exe
. If the program doesn't out itself when it can't findshutdown.exe
the next step is to put our own one in it's place.