Event ID 6006 — Event Log service shutdown

Event Log service stopped clean, usually during normal Windows shutdown.

Source of event

Event Log — System category.

Possible causes

• Normal stop
• Planned restart

Verifications to be carried out

1. Compare with 1074
2. A 6006 absence before a 6005 may indicate a sudden stop

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='System'; Id=6006} -MaxEvents 10

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.