How to View Crash Logs in Windows 11

Issue type: Windows diagnostics — locating and reading system crash logs. Applies to Windows 10 and Windows 11.

Short answer: To learn how to view crash logs in Windows 11, open Event Viewer with eventvwr.msc, then check Windows Logs > System for Critical and Error events around the crash time. For a simpler timeline, open Reliability Monitor. Use Event Viewer for restarts and service failures, Reliability Monitor for patterns, and C:\Windows\Minidump for blue screen dump files.

How to View Crash Logs in Windows 11: Start with Event Viewer

Event Viewer is the main place Windows records system-level crashes, failed services, driver problems, unexpected shutdowns, and blue screen follow-up events. It can look noisy, so the goal is not to fix every error you see. The goal is to find the events logged at the exact minute the crash happened.

1. Press Win + R, type eventvwr.msc, and press Enter.
2. In the left panel, expand Windows Logs.
3. Click System for unexpected restarts, power loss, driver failures, and Windows service problems.
4. In the right panel, click Filter Current Log.
5. Check Critical and Error, then click OK.
6. Open the entries logged at the crash time and read the Source, Event ID, and description.

Do not panic if you see many old errors. Windows logs routine service warnings all the time. Focus only on Critical and Error entries within one or two minutes before the crash.

Crash Events That Matter Most

These are the entries worth checking first:

• Event ID 41 — Kernel-Power: Windows restarted without a clean shutdown. This confirms the crash or power cut happened, but it does not identify the root cause by itself.
• Event ID 6008: Windows detected that the previous shutdown was unexpected.
• Event ID 1001 — Windows Error Reporting: Often includes bug check data after a blue screen.
• Event ID 7000 or 7009 — Service Control Manager: A service failed to start or timed out. This matters if the crash started after a Windows Update or driver update.
• Display driver errors: Events mentioning nvlddmkm, amdkmdag, igdkmdn, or similar driver names often point to GPU driver crashes.

If you see Kernel-Power 41 alone, keep looking. It is usually the symptom, not the cause. The useful clue is often another error logged seconds before it.

Use Reliability Monitor for a Cleaner Crash Timeline

Reliability Monitor is easier than Event Viewer because it shows crashes on a day-by-day graph. It is the best first tool when the PC crashes repeatedly but you do not remember the exact time.

1. Press Win + S and search for Reliability Monitor.
2. Open View reliability history.
3. Look for red X marks on the days the PC crashed.
4. Click the day that matches the crash.
5. Open the failed item and click View technical details.
6. Note the faulting application, module name, or hardware error shown there.

If the same driver, application, or Windows component appears several times, that repetition is the pattern. That is more useful than a single random error.

Find Blue Screen Minidump Files

If the crash was a blue screen, Event Viewer may only show that the restart happened. The real technical details are usually stored in a dump file.

1. Open File Explorer.
2. Go to C:\Windows\Minidump.
3. Look for recent .dmp files named by date.
4. If the folder is empty, open Advanced system settings > Startup and Recovery > Settings.
5. Set Write debugging information to Small memory dump.
6. Restart the PC so future blue screens create dump files.

For deep analysis, use WinDbg Preview from the Microsoft Store. Open the dump file and run:

!analyze -v

The output usually shows a suspected driver, module, or stop code.

Optional CMD Method: Pull Recent Critical Logs Fast

If Event Viewer is slow or you want a quick text output, open Command Prompt as Administrator and run:

wevtutil qe System /q:"*[System[(Level=1 or Level=2)]]" /c:20 /f:text

This lists the 20 most recent Critical and Error events from the System log. Copy the Event ID, Source, and timestamp, then compare it with the time the crash happened.

Common Mistake

The common mistake is treating every red error in Event Viewer as something that must be fixed. That wastes time. Windows can log harmless errors during startup, shutdown, and app updates. Only investigate errors that match the crash time, repeat consistently, or mention a specific driver, service, or bug check code. Random old errors are usually noise.

Best Next Step

Once you find the crash source, act based on the pattern. If the source is a driver, roll back or update that driver. If the source is Windows Update or a service timeout, check whether the issue started after a recent update and consider a component reset. The reset Windows Update components guide is the right next step when the log points to update services, corrupted update folders, or repeated Windows Update service failures. For the official Event Viewer entry point, see Open Event Viewer — Microsoft Support.

If crash logs mention Windows Update, compare the timing with Windows Update Error 0x800f0983 or a failed component update before changing drivers.

Frequently Asked Questions

Where are Windows 11 crash logs stored?

General crash logs are in Event Viewer under Windows Logs > System and Windows Logs > Application. Blue screen dump files are stored in C:\Windows\Minidump. Reliability Monitor shows the same crash history in a simpler visual timeline.

What does Event ID 41 mean?

Event ID 41 means Windows restarted without shutting down cleanly. It confirms that a crash, freeze, power loss, or forced shutdown happened. It does not prove the power supply is bad and it does not identify the original cause by itself.

Why is my Minidump folder empty after a blue screen?

Windows may not be configured to save small memory dumps, or the system may not have had enough time or disk space to write the file. Set Startup and Recovery to Small memory dump and keep free space on the C: drive so future crashes can be recorded.

Can I view crash logs if Windows will not boot?

Yes, sometimes. Try Safe Mode first and open Event Viewer from there. If Safe Mode does not work, boot from a Windows installation USB and copy C:\Windows\Minidump files to another drive for analysis on a working PC.

Should I install a crash cleaner or registry repair tool?

No. Crash logs are diagnostic records, not the cause of the crash. Deleting logs or cleaning the registry does not fix the driver, service, RAM, or storage issue that caused the crash. Use logs to identify the cause, then fix that cause directly.