Windows 10: Windows 10 - Event Log - no EventID 12, 13 anymore?

In the past I could filter on EventID 12 and EventID 13 to see actual shutdown and power on of my PC.
I freshly installed Windows again (latest x64 version) but going over the log files I do not detect these events anymore.

Does anyone out there has a clue ?
Anything to do with my powerplan settings ?

thanks!















:)

 

Change in Windows Defender?

Have you looked at the complete set of information related to that EventID 1013 for a specific recorded event?

In my case these have been occurring since day one on a Windows 8.1 system and the event recorded today, 2/16/2017 12:05:13 PM contains the following text in the General tab window.

Windows Defender has removed history of malware and other potentially unwanted software.

Time: ‎2/‎1/‎2017 12:05:13 PM

User: NT AUTHORITY\SYSTEM

From this you'll note that though this Defender History log cleanup activity occurs every day the PC is on, it's actually removing only the history from 2 weeks previous to that date and time.

Rob

Thanks. I hadn't noticed that, & probably should have. Although that "Time:" line is pretty confusing, since normally it would indicate time at which the event happened. And I'd have to go back a long, long way to find one that actually removed any history,
& how would I tell anyway?

 

My mom's computer randomly shuts down at night, even if it's uploading or downloading something

She is elderly and doesn't know how to turn it back on. What can I do to prevent this? I checked the Event Viewer and got this:

Log Name: System

Source: EventLog

Date: 12/14/2017 4:07:55 AM

Event ID: 6006

Task Category: None

Level: Information

Keywords: Classic

User: N/A

Computer: DESKTOP-Q4140LI

Description:

The Event log service was stopped.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="EventLog" />

<EventID Qualifiers="32768">6006</EventID>

<Level>4</Level>

<Task>0</Task>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2017-12-14T09:07:55.097413300Z" />

<EventRecordID>1105</EventRecordID>

<Channel>System</Channel>

<Computer>DESKTOP-Q4140LI</Computer>

<Security />

</System>

<EventData>

<Binary>01000000F2FFFFFF</Binary>

</EventData>

</Event>

Moved fromWindows / Windows 10 / Sleep and Power on/off)

 

Should I set : Allow hybrid sleep from ON to OFF ?
Should I set: Allow wake timers from Enable to Disable ?

=
Same Windows 10 x 64 14393.447 is running as VM
Eventviewer in VM does show 12/13

below, powerplan host-pc vs VM
eventviewer VM vs host-pc

I really wouldn't know ...

 

Yes, Hybrid Sleep should set to OFF. It is giving error ID 121
Yes, Wake timers, should set to Disabled.

If you have troubles with Power, then try restoring:
In Elevated Command Prompt, type: Powercfg /RestoredefaultSchemes

 

First of all, thanks for your feedback.
I did the above, but regretfully that didn't make any difference.

However . . .
I installed Windows on a Samsung Pro SSD which comes with Samsung Magician Software.
In the advanced settings there are items about hibernation, prefetch and a number of other things.
The hibernation wasn't de-activated there.
I did so just now and will check in the coming days. Hopefully EventID 12/13 will be back.

Anyway, many thanks for thinking along!

=