If you're looking to find the instances where a Windows PC was turned off unexpectedly (by removing power or crashing) use [[Event Viewer]] to filter System events for Event IDs `41`, and `6008`. Each instance of power being removed should log one of each of these events. 6008 indicates that the previous system shutdown was unexpected 41 indicates that the system has turned back on following an unclean shutdown To get this via Powershell: ```powershell Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 41, 6008; } | Format-List Id, LevelDisplayName, TimeCreated, Message ```