PowerShell script that alerts on unexpected restart/shutdown only
Summary The core issue is reliance on event IDs alone without distinguishing planned from unplanned shutdowns. The provided script triggers on any of the listed Event IDs (1074, 41, 6008, 1076, 13, 6006), which includes both scheduled maintenance and unexpected crashes. To make this actionable for production monitoring, we need to filter events by user … Read more