Monitoring error 6008 - something's amiss.

Products ITarian Endpoint Manager
1

I have ITSM set up to send me alerts for Error 6008, Unexpected Shutdown and I’ve been getting bombarded by them this weekend.

The last one to come through, I sent a command via my remote support software to tell me the last time it had been rebooted:

C:\WINDOWS\system32>net statistics workstation | find /i "statistics since"
Statistics since 8/29/2017 11:45:24 AM

So the PC hasn’t been rebooted in several days but I just got two alerts in two minutes that it had been shutdown.
Also another similar one yesterday, two weeks since last reboot but “error 6008” reported yesterday twice.

The one I got probably 20 reports on yesterday hadn’t been rebooted since mid-August (until I told it to do so yesterday).

2

Hi @PromptCare,

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the “Applies to” section.

Kindly check on the link below for additional information:
https://support.microsoft.com/en-us/help/326564/event-id-6008-is-unexpectedly-logged-to-the-system-event-log-after-you

3

Which only “applies to” Win2K. These are a little newer than that; Vista might be the oldest with most being 8.1 or 10.

4

@PromptCare ,

This means that your endpoint restarted or somehow shut down by itself possibly because of a system error, or someone turned the computer off without shutting Windows down first properly, or a power failure occurred (least I could think of). If there are many such events registering, this might indicate a memory (RAM) problem or hardware failure.