The previous system shutdown was unexpected

What it means

Logged at startup when the last shutdown wasn’t clean. Includes the time it happened.

Why it matters

Confirms an outage and when it occurred.

What to do

• Correlate with event 41 and with UPS or power logs.

Find it with PowerShell

Get-WinEvent -MaxEvents 20 -FilterHashtable @{
  LogName = 'System'; Id = 6008
} | Select-Object TimeCreated, ProviderName, Message

Add -ComputerName SERVER to query another machine. Other event sources can reuse the same ID number, so check the ProviderName column.