inspect-why-windows-did-shutdown

inspect-why-windows-did-shutdown

The Windows System event log already knows why the machine went down. Read it from WSL with powershell.exe -- there is no need to open the GUI, and no need to ask the user to go clicking.

WSL itself holds no record of this. WSL is torn down with the host, so uptime, last, and journalctl inside the distro say nothing about why Windows restarted. Always go to the Windows log.

Step 0: Confirm powershell.exe is reachable

command -v powershell.exe

If it is missing, WSL interop is off. Stop here and fall back to the GUI instructions.

Step 1: Always set the output encoding first

powershell.exe writes the log's Japanese text in Shift-JIS, which arrives as mojibake. Every command in this skill must start with:

[Console]::OutputEncoding=[Text.Encoding]::UTF8;

Strip the CR too, or the output is littered with \r: pipe through tr -d '\r'.

Step 2: Pull the shutdown events

powershell.exe -NoProfile -Command "[Console]::OutputEncoding=[Text.Encoding]::UTF8; Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,1074,6008,1001; StartTime=(Get-Date).AddDays(-3)} -ErrorAction SilentlyContinue | Sort-Object TimeCreated | ForEach-Object { '--- {0} / Id={1} / {2}' -f \$_.TimeCreated, \$_.Id, \$_.ProviderName; \$_.Message }" 2>&1 | tr -d '\r'

Reading the System log does not need Administrator.

-ErrorAction SilentlyContinue matters: Get-WinEvent -FilterHashtable throws when nothing matches, instead of returning empty. Without it, a clean machine looks like a failed command.

Widen AddDays(-3) if the event is older than the window.

Step 3: Read the four IDs

ID	Provider	What it means
1074	User32	Who initiated the shutdown/restart, and why. The one that answers the question
6008	EventLog	The previous shutdown was unexpected -- power loss, hard freeze, held power button
41	Kernel-Power	The system rebooted without shutting down cleanly
1001	BugCheck	A blue screen, with the stop code and dump path