Event ID 41 is only telling that Windows did not shut down cleanly. In this case, the important detail is that Event ID 41 contains a nonzero BugcheckCode (59), which means the restart is associated with a Stop error rather than a simple power loss.
Use this path:
- Treat this as a blue screen/bugcheck issue first
- Event ID 41 with a bugcheck code means Windows captured Stop error data during the unexpected restart.
- The bugcheck code in Event ID 41 is shown in decimal, while most bugcheck documentation uses hexadecimal.
- Convert BugcheckCode 59 to hexadecimal
- Open Start and search for Calculator.
- In Calculator, select View > Programmer.
- Make sure Dec is selected.
- Enter
59. - Select Hex.
- Use the 8-digit form when checking documentation.
- Check whether the shutdown was forced by the power button
- In the event data provided, PowerButtonTimestamp = 0.
- That does not match the documented pattern for a restart caused by pressing and holding the power button.
- Since Safe Mode is stable, focus on drivers and normal-boot components
- Safe Mode working normally means the issue appears during a normal Windows startup path, where additional drivers and services load.
- Because Event ID 41 already includes a bugcheck code, continue with Stop error troubleshooting rather than treating this as a pure power event.
- Check for related events around the crash time
- In Event Viewer > Windows Logs > System, look for these around the same time:
- Event ID 6008 for the unexpected shutdown time
- Event ID 1074 to confirm whether any app or user initiated shutdown/restart
- Event ID 6006 to see whether Windows completed a clean shutdown
- Also check both Application and System logs for suspicious events just before the Event ID 41 time.
- In Event Viewer > Windows Logs > System, look for these around the same time:
- If Windows is restarting too quickly to identify the Stop error, disable automatic restart
- Right-click My Computer > Properties > Advanced system settings > Advanced.
- Under Startup and Recovery, select Settings.
- Clear Automatically restart.
- This helps keep the Stop error visible instead of immediately rebooting.
- If Event ID 41 later shows all zero values, check dump configuration
- If Event ID 41 has zeros and there is Event ID 46 from volmgr saying Crash dump initialization failed!, check the pagefile configuration.
- The default dump file is the pagefile, and if dump initialization fails, Windows may not record the bugcheck type or create a memory dump.
- If the cause is still unclear, check the hardware-related items documented for random restarts
- Disable any overclocking.
- Check memory health and configuration.
- Check the power supply capacity.
- Check for overheating.
- If all checks fail to isolate the issue, return the system to its default configuration and test again.
Based on the provided event data, the strongest supported conclusion is:
- this is not just a generic Kernel-Power event,
- it is a bugcheck-driven restart,
- and Safe Mode stability makes normal-boot drivers/services the most relevant next area to investigate.
References: