Previous shutdown unexpected

Question

Previous shutdown unexpected

Hero1318 40

Win 11 Pro 25H2 running on desktop PC with i7-9700, 16 GB RAM, NVidia GPU.

Since updating to 25H2 about two weeks ago, I see Event ID 6008 in Event Viewer every morning after PC is cold booted. Never saw this error while running Win 11 23H2, or Win 10 before that.

"The previous system shutdown at {time} on {date} was unexpected."

The shutdown date/time indicated are when PC was shut down normally the previous day using Power>Shutdown from the Start menu. Have run DISM restore health and SFC, several times, but the same event still gets logged the next day.

Any ideas how to fix this...?

2 answers

Your answer

Answer 1

JANSHER L 7,925 Independent Advisor

Hi Hero1318,

Thank you for posting, I am here to help. Possible reason you are getting this error is due to the computer lost power or crashed without a proper shutdown process.

Please follow this steps see if this will help:

Check for Overheating: Ensure that your PC is not overheating during using it.

Inspect Power Supply: A faulty or insufficient power supply can cause unexpected shutdowns.

Update Drivers: Ensure that all your drivers, especially graphics drivers, are up to date.

Run Hardware Diagnostics: Use built-in diagnostics tools or third-party software to check for hardware issues.

looking forward to helping you out.  If you need more help please let me know. If the answer is helpful, please click "Accept Answer".

Best regards,

Jansher

Hero1318 40 Reputation points

2025-11-25T20:35:35.71+00:00

@JANSHER L - Thanks, but that's exactly what this forum's AI assistant said after I posted my OP, none of which helps solve the problem.

My PC can't be overheated when it's cold booted after having been shut down (at the mains) for an entire night. It has an 850W PSU and only USB mouse, keyboard, monitor, speakers are connected when I power the system on in morning.

It runs normally all day despite Event ID 6008 after it's cold booted, without crashing. CPU is only at 32ºC (2% utilization) while I type this, and -at most- might get up to ~50ºC (~10-12% utilization) when doing something heavy, and it still doesn't crash.

Have latest BIOS and hardware drivers that I can find. Windows Update typically updates NVidia drivers when available, and I ran Intel's SupportAssistant, which didn't offer any newer updates.

Something (hidden) must be going wrong during normal shutdowns that makes Win 11 think that was "unexpected" when it boots the next morning. I close anything that's open before shutting down, and don't see any error messages or delays in shutting down.

Other suggestions?

Answer 2

Lucus-V 2,845 Microsoft External Staff Moderator

Hi Hero1318,
Welcome to Microsoft Q&A forum. I'm happy to help.

The Event Viewer ID 6008 is usually caused by CPU or PSU.

Please enter your BIOS and disable C-Stage to see if the issue is gone. You may also have to disable related C-Stage settings, just do that one by one to prevent disabling unnecessary options.

If modifying BIOS settings does not help, please consider trying another PSU.

I hope that above information is helpful to you and can help you fix the issue.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Lucus-V 2,845 Reputation points Microsoft External Staff Moderator

2025-11-28T11:37:51.0433333+00:00

Hi Hero1318,
I hope everything is going well on your end. Just wanted to check in and see how things are going for you lately, anything you'd like to share or discuss?
Hero1318 40 Reputation points

2025-11-28T21:47:28.3+00:00

Still getting same Win 11 error on cold-booting saying "The previous system shutdown at {time} on {date} was unexpected.", showing shutdown time/date for the previous night's normal Start>Power>Shutdown shutdown. And occasional random freezes while PC is running, but no errors reported in Event Viewer.

Ran all the build-in hardware tests for CPU, GPU and RAM without any errors reported. Uninstalled NVidia driver using DDU in safe mode and reinstalled the latest one from NVidia site, reinstalled audio driver (same, latest version that I had). Ran chkdsk, etc too and no issues reported.

All of this started after upgrading from Win 11 23H2 to 25H2...
Lucus-V 2,845 Reputation points Microsoft External Staff Moderator

2025-12-01T04:55:09.7133333+00:00

Hi Hero1318,

Please open Core isolation and check the state of Memory integrity. If it's enabled, try disabling it to see if the issue is gone.

In case you face random freezes, please navigate to C:\Windows\Minidump, if you see files there: zip some most recent them, upload to OneDrive then send me the public link.

Thank you for your time.
Hero1318 40 Reputation points

2025-12-02T01:04:07.98+00:00

Thanks for following up.

Memory integrity has always been off on this PC, so that's not the problem.

I get this BSOD sometimes when cold booting, but not every time:

The problem seems to be caused by the following file: ntoskrnl.exe

ntoskrnl.exe - Address 0xfffff801d64f6880 base at 0xfffff801d6000000 DateStamp

0x9688d60f

0x133(0x0, 0x500, x500, 0xFFFFF801D6FC43B0)

Bugcheck name: DPC_WATCHDOG_VIOLATION

__Bug check description:__The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL or above. This could be caused by either a non-responding driver or non-responding hardware. This bug check can also occur because of overheated CPUs (thermal issue).

Event Viewer is also listing this one or more times a day, even when PC doesn't BSOD at boot:

'packageChanges-1' failed for S-1-5-18. Error: 'A specified logon session does not exist. It may already have been terminated.' (0 seconds).

I've reinstalled/updated every driver I can, eg, GPU, audio, networking (ethernet, WiFi, Bluetooth), Logitech wireless USB mouse, monitor, etc.

When PC freezes while in use, I don't get a .dmp file and nothing gets reported in Event Viewer, aside from a kernel 41 error because of the forced reboot.

DISM restore health, sfc, and chkdsk don't report any errors. All hardware passes built-in diagnostics...
Lucus-V 2,845 Reputation points Microsoft External Staff Moderator

2025-12-02T03:59:31.6066667+00:00

Hi Hero1318,
Thank you for your information.

If you got BSOD, it's strange that there's no dump files. Please wait for the BSOD to collect dump completely.

Please try an alternative forced shutdown with Command Prompt (Run as Administrator): shutdown /s /f /t 0

Based on your error code and your description, please use a third-party tool such as Memtest or Memtest86 for memory testing.

It is recommended to run memory tests in DDOS or standalone environments and run them for at least 3-4 cycles to ensure that memory is adequately tested.

Disclaimer: Microsoft provides no assurances and/or warranties, implied or otherwise, and is not responsible for the information you receive from the third-party linked sites or any support related to technology.

If the memory test returns any errors, there may be a problem with the CPU memory chipset, overclocking configuration, or the memory hardware itself.

While you have result of memory test, please keep me updated.
Hero1318 40 Reputation points

2025-12-03T02:16:35.7433333+00:00

I've the OEM's RAM and CPU diagnostics in their standalone environment entirely outside of Windows for multiple cycles, each. Neither reported any errors. CPU is not overclocked (not an option BIOS).

Tried something different... I disabled Fast Startup in Win 11 25H2 before shutting down last night. So far today, it cold booted normally, no sudden total freezes while running, and no Critical or Errors in Event Viewer. Just a few Warnings:

1: Process C:\Windows\explorer.exe is delaying system shutdown after 5016 milliseconds. (Date/time of last night's normal shutdown)

2: The driver \Driver\WUDFRd failed to load.

Log Name: System

Source: Microsoft-Windows-Kernel-PnP

Date: 12/2/2025 3:07:28 PM

Event ID: 219

Task Category: (212)

Level: Warning

Keywords: (8192)

User: SYSTEM

Device: SWD\DRIVERENUM{1d7f5858-08a3-446f-830a-766a146ebf3a}#Micron_MTFDHBA_component&5&157be28&0

Status: 0xC0000365

Don't know why WUDFRd failed to load. Micron is 512 GB SSD boot drive. There's WUDFRd.inf in C:\Windows\Inf and WUDFRd.Sys in C:\Windows\System32\Drivers. CrystalDiskInfo rates this drive as "Good, 93%," and it seems to be working OK and has latest firmware.

3: AESMService: White List update failed due to network error.

Source: AESMService

Date: 12/2/2025 3:09:39 PM

Event ID: 103

Task Category: None

Level: Warning

Keywords:

User: SYSTEM

Computer: DESKTOP-J0JA0D5

Description:

AESMService: White List update failed due to network error

Intel SGX AESMService is running in services.msc, Automatic (Delayed Start)

Will test for a few days with Fast Startup disabled in Windows and see if the problems come back.
Lucus-V 2,845 Reputation points Microsoft External Staff Moderator

2025-12-03T03:10:17.59+00:00

Hi Hero1318,
It's good to hear that some changes improve the situation.

Let's track it for few days. And if you need further assistance, please feel free to let me know.

Share via

Previous shutdown unexpected

2 answers

Your answer