事件 ID 41 的高级疑难解答:"系统已重启,无需首先完全关闭"Advanced troubleshooting for Event ID 41: "The system has rebooted without cleanly shutting down first"

家庭用户 本文供支持代理和 IT 专业人员使用。Home users This article is intended for use by support agents and IT professionals. 如果要查找有关蓝屏错误消息的详细信息,请访问蓝屏 错误疑难解答If you're looking for more information about blue screen error messages, please visit Troubleshoot blue screen errors.

关闭 Windows 的首选方法为选择"开始****",然后选择关闭或关闭计算机的选项。The preferred way to shut down Windows is to select Start, and then select an option to turn off or shut down the computer. 使用此标准方法时,操作系统将关闭所有文件,并通知正在运行的服务和应用程序,以便它们可以将任何未保存的数据写入磁盘并刷新任何活动缓存。When you use this standard method, the operating system closes all files and notifies the running services and applications so that they can write any unsaved data to disk and flush any active caches.

如果计算机意外关闭,Windows 在计算机下次启动时将记录事件 ID 41。If your computer shuts down unexpectedly, Windows logs Event ID 41 the next time that the computer starts. 事件文本类似于以下内容:The event text resembles the following:

事件 ID:41Event ID: 41
说明:系统已重启,无需首先完全关闭。Description: The system has rebooted without cleanly shutting down first.

此事件指示某些意外活动阻止了 Windows 正确关闭。This event indicates that some unexpected activity prevented Windows from shutting down correctly. 此类关机可能是由电源中断或停止错误导致的。Such a shutdown might be caused by an interruption in the power supply or by a Stop error. 如果可行,Windows 将记录关闭时的任何错误代码。If feasible, Windows records any error codes as it shuts down. 在下次 Windows 启动的 内核阶段,Windows 会检查这些代码,并包括事件 ID 41 的事件数据中任何现有代码。During the kernel phase of the next Windows startup, Windows checks for these codes and includes any existing codes in the event data of Event ID 41.

EventDataEventData
BugcheckCode 159BugcheckCode 159
BugcheckParameter1 0x3BugcheckParameter1 0x3
BugcheckParameter2 0xfffffa80029c5060BugcheckParameter2 0xfffffa80029c5060
BugcheckParameter3 0xfffff8000403d518BugcheckParameter3 0xfffff8000403d518
BugcheckParameter4 0xfffffa800208c010BugcheckParameter4 0xfffffa800208c010
SleepInProgress falseSleepInProgress false
PowerButtonTimestamp 0Converts 0x9f (0x3、0xfffffa80029c5060、0xfffff8000403d518、0xfffffa800208c010) PowerButtonTimestamp 0Converts to 0x9f (0x3, 0xfffffa80029c5060, 0xfffff8000403d518, 0xfffffa800208c010)

解决意外关闭或重启问题时如何使用事件 ID 41How to use Event ID 41 when you troubleshoot an unexpected shutdown or restart

事件 ID 41 本身可能不足以明确定义发生的情况。By itself, Event ID 41 might not contain sufficient information to explicitly define what occurred. 通常,您还必须考虑发生意外关机时发生的情况 (例如,电源故障) 。Typically, you have to also consider what was occurring at the time of the unexpected shutdown (for example, the power supply failed). 使用本文中的信息确定适用于您的情形的疑难解答方法:Use the information in this article to identify a troubleshooting approach that is appropriate for your circumstances:

  • 方案 1:由于"停止"错误而重新启动计算机,并且事件 ID 41 包含"停止"错误 (错误检查) 代码Scenario 1: The computer restarts because of a Stop error, and Event ID 41 contains a Stop error (bug check) code
  • 方案 2:由于你按下并按住电源按钮,计算机会重新启动Scenario 2: The computer restarts because you pressed and held the power button
  • 方案 3:计算机无响应或随机重新启动,未记录事件 ID 41 或事件 ID 41 条目列出了错误代码值 0Scenario 3: The computer is unresponsive or randomly restarts, and Event ID 41 is not logged or the Event ID 41 entry lists error code values of zero

方案 1:由于"停止"错误而重新启动计算机,并且事件 ID 41 包含"停止"错误 (错误检查) 代码Scenario 1: The computer restarts because of a Stop error, and Event ID 41 contains a Stop error (bug check) code

当计算机因停止错误而关闭或重新启动时,Windows 将在事件 ID 41 中包含 Stop 错误数据作为其他事件数据的一部分。When a computer shuts down or restarts because of a Stop error, Windows includes the Stop error data in Event ID 41 as part of the additional event data. 此信息包括 Stop 错误代码 (也称为错误检查代码) ,如以下示例所示:This information includes the Stop error code (also called a bug check code), as shown in the following example:

EventDataEventData
BugcheckCode 159BugcheckCode 159
BugcheckParameter1 0x3BugcheckParameter1 0x3
BugcheckParameter2 0xfffffa80029c5060BugcheckParameter2 0xfffffa80029c5060
BugcheckParameter3 0xfffff8000403d518BugcheckParameter3 0xfffff8000403d518
BugcheckParameter4 0xfffffa800208c010BugcheckParameter4 0xfffffa800208c010

备注

事件 ID 41 包含十进制格式的错误检查代码。Event ID 41 includes the bug check code in decimal format. 大部分描述错误检查代码的文档将代码引用为十六进制值,而不是十进制值。Most documentation that describes bug check codes refers to the codes as hexadecimal values instead of decimal values. 若要将十进制数转换为十六进制数,请按照以下步骤操作:To convert decimal to hexadecimal, follow these steps:

  1. 选择 "开始",在"搜索"框中键入calc, 然后选择"计算器 "。Select Start, type calc in the Search box, and then select Calculator.
  2. 在"计算器" 窗口中,选择"查看 > 程序员"。In the Calculator window, select View > Programmer.
  3. 在计算器左侧,验证 "Dec" 是否突出显示。On the left side of calculator, verify that Dec is highlighted.
  4. 使用键盘输入错误检查代码的小数值。Use the keyboard to enter the decimal value of the bug check code.
  5. 在计算器左侧,选择 "十六进制"。On the left side of the calculator, select Hex.
    计算器显示的值现在是十六进制代码。The value that the calculator displays is now the hexadecimal code.

将错误检查代码转换为十六进制格式时,请验证"0x"指定后跟八个数字 (即,"x"后的代码部分包含足以填写八位数的零) 。When you convert a bug check code to hexadecimal format, verify that the “0x” designation is followed by eight digits (that is, the part of the code after the “x” includes enough zeros to fill out eight digits). 例如,0x9F通常记录为0x0000009f,0xA记录为0x0000000A。For example, 0x9F is typically documented as 0x0000009f, and 0xA is documented as 0x0000000A. 对于本文中的示例事件数据,"159"将转换为0x0000009f。In the case of the example event data in this article, "159" converts to 0x0000009f.

确定十六进制值后,请使用以下引用继续疑难解答:After you identify the hexadecimal value, use the following references to continue troubleshooting:

方案 2:由于你按下并按住电源按钮,计算机会重新启动Scenario 2: The computer restarts because you pressed and held the power button

由于重新启动计算机的此方法会干扰 Windows 关闭操作,因此建议您仅在没有替代方法时使用此方法。Because this method of restarting the computer interferes with the Windows shutdown operation, we recommend that you use this method only if you have no alternative. 例如,如果计算机未响应,可能必须采用此方法。For example, you might have to use this approach if your computer is not responding. 通过长按电源按钮重新启动计算机时,计算机会记录事件 ID 41,其中包括 PowerButtonTimestamp 条目的非零值。When you restart the computer by pressing and holding the power button, the computer logs an Event ID 41 that includes a non-zero value for the PowerButtonTimestamp entry.

有关对无响应计算机进行故障排除的帮助,请参阅 Windows 帮助For help when troubleshooting an unresponsive computer, see Windows Help. 请考虑使用关键字(如"挂起"、"响应"或"空白屏幕")搜索帮助。Consider searching for assistance by using keywords such as "hang," "responding," or "blank screen."

方案 3:计算机无响应或随机重新启动,并且未记录事件 ID 41 或事件 ID 41 条目或列出错误代码值 0Scenario 3: The computer is unresponsive or randomly restarts, and Event ID 41 is not recorded or the Event ID 41 entry or lists error code values of zero

此方案包括以下情况:This scenario includes the following circumstances:

  • 关闭无响应计算机的电源,然后重新启动计算机。You shut off power to an unresponsive computer, and then you restart the computer.
    若要验证计算机是否无响应,请按键盘上的 CAPS LOCK 键。To verify that a computer is unresponsive, press the CAPS LOCK key on the keyboard. 如果在按 CAPS LOCK 键时键盘上的 CAPS LOCK 指示灯未更改,则计算机可能完全无响应 (也称作硬挂起) 。 **If the CAPS LOCK light on the keyboard does not change when you press the CAPS LOCK key, the computer might be completely unresponsive (also known as a hard hang).
  • 计算机会重新启动,但它不会生成事件 ID 41。The computer restarts, but it does not generate Event ID 41.
  • 计算机重新启动并生成事件 ID 41,但 BugcheckCodePowerButtonTimestamp 值为零。The computer restarts and generates Event ID 41, but the BugcheckCode and PowerButtonTimestamp values are zero.

在这种情况下,某些内容会阻止 Windows 生成错误代码或将错误代码写入磁盘。In such cases, something prevents Windows from generating error codes or from writing error codes to disk. 某些内容可能会阻止对磁盘 (如无响应的计算机) 或者计算机关闭速度可能过快,无法编写错误代码,甚至检测到错误。Something might block write access to the disk (as in the case of an unresponsive computer) or the computer might shut down too quickly to write the error codes or even detect an error.

事件 ID 41 中的信息提供了从何处开始检查问题的一些指示:The information in Event ID 41 provides some indication of where to start checking for problems:

  • 未记录事件 ID 41 或错误检查代码为零Event ID 41 is not recorded or the bug check code is zero. 此行为可能表示电源问题。This behavior might indicate a power supply problem. 如果计算机电源中断,计算机可能会关闭,而不会生成停止错误。If the power to a computer is interrupted, the computer might shut down without generating a Stop error. 如果确实生成 Stop 错误,可能无法将错误代码写入磁盘。If it does generate a Stop error, it might not finish writing the error codes to disk. 计算机下次启动时,可能不会记录事件 ID 41。The next time the computer starts, it might not log Event ID 41. 或者,如果有,则 bug 检查代码为零。Or, if it does, the bug check code is zero. 以下条件可能是原因:Conditions such as the following might be the cause:

    • 对于便携计算机,电池已删除或完全排出。In the case of a portable computer, the battery was removed or completely drained.
    • 对于台式计算机,计算机已拔出或遇到断电。In the case of a desktop computer, the computer was unplugged or experienced a power outage.
    • 电源不足或出错。The power supply is underpowered or faulty.
  • PowerButtonTimestamp 值为零The PowerButtonTimestamp value is zero. 如果将电源断开到未响应输入的计算机,则可能会发生此行为。This behavior might occur if you disconnected the power to a computer that was not responding to input. 以下条件可能是原因:Conditions such as the following might be the cause:

    • Windows 进程阻止了对磁盘的写入访问,并且你通过长按电源按钮至少四秒钟来关闭计算机。A Windows process blocked write access to the disk, and you shut down the computer by pressing and holding the power button for at least four seconds.
    • 断开了与无响应计算机的电源的连接。You disconnected the power to an unresponsive computer.

通常,此方案中描述的症状表示存在硬件问题。Typically, the symptoms described in this scenario indicate a hardware problem. 若要帮助隔离该问题,请执行下列操作:To help isolate the problem, do the following:

  • 禁用过度锁定Disable overclocking. 如果计算机已启用超锁定,则禁用它。If the computer has overclocking enabled, disable it. 确认当系统以正确的速度运行时出现问题。Verify that the issue occurs when the system runs at the correct speed.
  • 检查内存Check the memory. 使用内存检查器确定内存运行状况和配置。Use a memory checker to determine the memory health and configuration. 验证所有内存芯片是否以相同的速度运行,以及每个芯片在系统中是否配置正确。Verify that all memory chips run at the same speed and that every chip is configured correctly in the system.
  • 检查电源Check the power supply. 验证电源是否有足够的空间来适当处理已安装的设备。Verify that the power supply has enough wattage to appropriately handle the installed devices. 如果你添加了内存、安装了较新的处理器、安装了其他驱动器或添加了外部设备,则此类设备需要比当前电源持续提供更多的能耗。If you added memory, installed a newer processor, installed additional drives, or added external devices, such devices can require more energy than the current power supply can provide consistently. 如果计算机由于电源中断而记录事件 ID 41,请考虑获取不间断电源 (UPS) 如电池备份电源。If the computer logged Event ID 41 because the power to the computer was interrupted, consider obtaining an uninterruptible power supply (UPS) such as a battery backup power supply.
  • 检查是否正在检测Check for overheating. 检查硬件的内部温度并检查任何安装组件。Examine the internal temperature of the hardware and check for any overheating components.

如果执行这些检查但仍无法隔离问题,请设置系统的默认配置并验证问题是否仍发生。If you perform these checks and still cannot isolate the problem, set the system to its default configuration and verify whether the issue still occurs.

备注

如果看到包含错误检查代码的"停止"错误消息,但事件 ID 41 不包含该代码,请更改计算机的重新启动行为。If you see a Stop error message that includes a bug check code, but Event ID 41 does not include that code, change the restart behavior for the computer. 为此,请执行下列步骤:To do this, follow these steps:

  1. 右键单击 "我的电脑", 然后选择"属性 > ""高级系统设置 > ""高级"。Right-click My Computer, then select Properties > Advanced system settings > Advanced.
  2. 在"启动和恢复"部分, 选择"设置 "。In the Startup and Recovery section, select Settings.
  3. 清除" 自动重启 "复选框。Clear the Automatically restart check box.