I’m not finding any events surrounding the event, except a bunch of audit failures around bing accesses
Cryptographic operation.
Subject:
Security ID: THUNDERBOLT\Thomas Perry
Account Name: Thomas Perry
Account Domain: THUNDERBOLT
Logon ID: 0x29DDE1
Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: UNKNOWN
Key Name: TB_0_bing.com
Key Type: User key.
Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
And a bunch of these
Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.
Error Code: 2
But those were all about 2 hours before the event. There doesn’t seem to be any record of the event except for some mentions of repair when I repaired the disk.
Maybe I’m looking in the wrong place? I checked all the logs under Windows Logs and Applications and Services Logs
Nevermind, found this
The previous system shutdown at 10:13:56 PM on 3/13/2021 was unexpected.
.
[-](#) <Event xmlns="**http://schemas.microsoft.com/win/2004/08/events/event** ">
[-](#) <System>
<Provider Name="**EventLog** " />
<EventID Qualifiers="**32768** ">6008</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="**2021-03-14T04:36:29.5006563Z** " />
<EventRecordID>23575</EventRecordID>
<Correlation />
<Execution ProcessID="**0** " ThreadID="**0** " />
<Channel>System</Channel>
<Computer>Thunderbolt</Computer>
<Security />
</System>
[-](#) <EventData>
<Data>10:13:56 PM</Data>
<Data>3/13/2021</Data>
<Data />
<Data />
<Data>75432</Data>
<Data />
<Data />
<Binary>E507030006000D0016000D0038006402E507030000000E0003000D0038006402600900003C000000010000006009000001000000B00400000000000000000000</Binary>
</EventData>
</Event>