Share via

Windows 11 Update - Severe Crash - Lost 12 hours of work - Can the Event Logs Shed Light on This?

=D 20 Reputation points
2025-12-05T17:22:29.5533333+00:00

Last night I left my computer on before leaving my office (around 7PM). During that same evening the machine crashed hard. The crash wasn't discovered until the next morning - and required a power cycle to restore normal operation.

Before leaving my office, I was running professional engineering software that normally runs for days. Because my system crashed and had stopped for 12 hours - I lost data that could have been calculated during the night.

The next morning, I came into my office at 8 AM and observed my workstation was dead frozen. The mouse wouldn't move. Although you could see all windows open from the previous evening the computer wasn't responsive at all - nothing responded - not even in the slightest way. It was as if the computer screen were a still picture. The keyboard wasn't initiating a response either - and the lights on the keyboard were frozen as well.

This was a very severe crash. Power cycling was the only option I could think of.

Shortly after power cycling and rebooting I had a look at the Event Viewer - under Windows Logs >> System. This (screen capture below) was the last entry before all logs stopped (until I power cycled the machine this morning). It looks like a Windows Update crashed the system. For the next 12 hours there were zero logs recorded by the Event Viewer - even though the computer had been powered on that entire time.

In the image capture below the Error log (in red) was created this morning after I power cycled the machine and has the message,

"The previous system shutdown at 8:11:00 PM on ‎12/‎4/‎2025 was unexpected."

So, my question is this (roughly):

Are there any other logs I could look at to gain a better idea as to what caused such a severe crash?

Windows-11_Update_Crash_-_2025-12-05_09-05-54

Windows for business | Windows 365 Business

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. VPHAN 9,355 Reputation points Independent Advisor
    2025-12-05T18:19:08.24+00:00

    Good morning =D,

    I completely understand the frustration here. The behavior you described, known as a "Hard Hang," means that the Windows Kernel or the hardware itself locked up so tightly that the operating system could not even execute the command to write an error log to the hard drive. This explains why your Event Viewer stops abruptly at 8:08 PM without a specific error code leading up to the silence.

    Based on your screenshot, the very last recorded activity was a "Successful" installation of a Security Intelligence Update for Microsoft Defender (KB2267602). While the update installed successfully, Defender triggers an automatic "Quick Scan" or file assessment immediately after definition updates. If your engineering software was actively writing large or complex temporary files at that moment, a deadlock could have occurred between the Antivirus filter driver (MsMpEng.exe) and the storage I/O, causing the freeze.

    To dig deeper than the standard Event Viewer, we need to look at logs that are generated outside the standard system stream or reconstruct the update behavior. First, open PowerShell as an administrator and run Get-WindowsUpdateLog. This command will generate a file named WindowsUpdate.log on your desktop. Open this text file and scroll to the timestamp 20:08 (8:08 PM). You are looking for what happened after the "Success" message. If the log ends abruptly there too, the freeze was instantaneous. If the log continues, look for lines mentioning "Post-install" or "Reboot required," which would indicate if the system attempted a power state transition that failed.

    Next, you should inspect the specific Microsoft Defender logs, as that was the last active process. Navigate to C:\ProgramData\Microsoft\Windows Defender\Support and look for MPLog-xxxxxxxx-xxxxxx.log. Open the most recent one. Search for the timestamp around 8:08 PM. If you see a scan initiating on a directory used by your engineering software right before the log ends, you have found your culprit. You may need to create a process exclusion or folder exclusion in Defender for your engineering application to prevent future locks.

    Finally, checking the Reliability Monitor often provides a better "crash timeline" than Event Viewer. Press Win + R, type perfmon /rel, and hit Enter. Look at the column for the day of the crash. It might show "Hardware Errors" (LiveKernelEvent) that occurred prior to the freeze which didn't make it to the main System log. If you see code 141 or 117 listed there, it indicates the GPU driver hung (common with engineering software), and the screen froze because the video card stopped updating the display buffer.

    I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to ACCEPT ANSWER. Should you have more questions, feel free to leave a message. Have a nice day!

    VP

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.