Event ID 41 Kernel-Power After an Unexpected Restart and How to Find the Cause

This post first appeared on the ET Ducky blog. I build ET Ducky, an RMM that reads ETW on Windows and eBPF on Linux. Event ID 41 from Microsoft-Windows-Kernel-Power is a Critical event in the System log. The message reads "The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly." Windows logs it…