Windows · Crash diagnosis

The crash happened first. Event 41 came later.

Kernel-Power records an unclean ending. It does not name the killer.

By Marcin Firmuga·Published 2026-07-30·17 min read

The screen goes black in the middle of a game. The fans stop for a moment, the motherboard logo returns, and Windows starts as if someone pressed Reset. There was no blue screen and no useful message. Event Viewer shows one red critical entry: Kernel-Power, Event ID 41.

That entry looks like the answer because it is marked Critical. It is not. Windows writes Event 41 on the next startup when it discovers that the previous session did not shut down cleanly. The useful evidence is inside its fields, in a possible memory dump and in the seconds before the shutdown. Searching only for “fix Kernel-Power 41” starts the investigation at the end of the story.

The first job is to separate three different failures that can produce the same visible restart: a hidden Stop error, a hard hang that forced a reset, and a loss of power too abrupt for Windows to record the cause.

1. Hidden Stop error BugcheckCode > 0

Windows detected a bug check. Convert the decimal code to hexadecimal and inspect the dump or BugCheck event 1001.

2. Forced power button PowerButtonTimestamp > 0

The long press interrupted shutdown. The unresolved question is what made the machine stop responding first.

3. Evidence could not be saved both values = 0

Power may have vanished, the system may have hard-hung, or dump creation may have failed.

In this guide
  1. What Kernel-Power 41 actually means
  2. Read the fields, not the red icon
  3. Build the minute before the restart
  4. A safe isolation order
  5. What each restart pattern changes
  6. Where PC Workman helps, and where it cannot

What Kernel-Power 41 actually means

Event 41 says that Windows restarted without completing the normal shutdown sequence. It can follow a power interruption, a Stop error, a frozen machine switched off by the user or a reset performed by firmware. The common fact is the missing clean shutdown, not a common root cause.

This distinction prevents the most expensive diagnostic mistake: replacing the power supply because the event source contains the word “Power.” A faulty or undersized PSU remains a possible cause of an instant blackout, but software cannot prove PSU health from Event 41 or a motherboard voltage sensor. The separate PSU diagnosis guide explains what voltage readings can and cannot establish.

Write down the exact time and physical behaviour. Did the lights and fans die? Did audio loop? Did the display go black while the PC stayed on? Did it restart instantly or wait? Did Caps Lock still toggle? These observations can be more useful than the word “Critical.”

Read the fields, not the red icon

Open Event Viewer, go to Windows Logs → System, open Event ID 41, then use the Details tab and XML view. The following fields choose the next branch.

Field or eventWhat it establishesNext step
BugcheckCode is nonzeroWindows recorded a Stop error code, shown in decimal.Convert it to hexadecimal, find BugCheck event 1001 and inspect the matching dump.
PowerButtonTimestamp is nonzeroA long power-button press interrupted the session.Investigate the hang that made the forced shutdown necessary.
Both are zeroWindows did not save a Stop code or button timestamp.Check for abrupt power loss, a hard hang and failed dump creation.
volmgr Event 46Crash dump initialization failed.Check the page file and dump configuration before concluding there was no bug check.
BugCheck Event 1001A Stop error and dump path were recorded.Use the specific stop code, not Event 41, for the next search.
Event 6008The previous shutdown was unexpected and supplies a reference time.Inspect System and Application logs immediately before that timestamp.

Microsoft documents an easy-to-miss detail: Event 41 stores BugcheckCode in decimal, while most bug-check documentation uses hexadecimal. A decimal value of 159, for example, becomes 0x0000009F. Searching the decimal number as if it were the documented Stop code can send the investigation in the wrong direction.

Make the next crash leave evidence

A blue screen can disappear instantly when automatic restart is enabled. In Advanced system settings, open Startup and Recovery and clear Automatically restart while diagnosing. Confirm that Windows is configured to write an automatic or kernel memory dump and that the system-managed page file on the OS volume has not been disabled.

This does not prevent a crash. It gives Windows a chance to preserve the Stop code and dump. It also cannot help when power vanishes before the operating system can write anything. A missing dump is therefore a clue to investigate, not proof that no software or driver failure occurred.

Build the minute before the restart

Event 41 is after the event. Work backwards from its timestamp. Check the System and Application logs just before Event 6008, then open Reliability Monitor with perfmon /rel. Reliability Monitor presents application failures, Windows failures, updates and driver installations on one day-by-day timeline. It is easier to read than thousands of unrelated Event Viewer entries.

Look for a repeated neighbour, not any red line. The same WHEA event before three restarts matters. One DCOM warning that appears every day on a stable PC probably does not. Timestamp correlation is the start. Repetition under the same workload turns it into evidence.

A safe isolation order

  1. Preserve the current evidence. Photograph the fields, note the exact time, check dumps and Reliability Monitor before changing settings.
  2. Return performance tuning to default. Temporarily disable CPU and GPU overclocking, undervolting and XMP/EXPO. A profile that boots is not automatically stable. Use the RAM stability guide for a controlled A/B test.
  3. Log temperatures and clocks. Repeat the smallest workload that reproduces the issue. Stop if temperatures become unsafe or the machine smells, sparks or makes new electrical noise.
  4. Separate the workload. Does a GPU-heavy game fail while a CPU-only task does not? Does the restart happen at idle as well? Does it follow one game, one driver update or any combined load?
  5. Check memory at default settings. A real memory test and a stable baseline are stronger than swapping random Windows settings.
  6. Inspect physical power without opening the PSU. Reseat external power leads with the PC unplugged, verify GPU connectors and avoid daisy-chained connectors where the GPU vendor requires separate cables. Never open a power supply.
  7. Change one item. One driver version, one memory profile, one cable arrangement or one borrowed known-good component. Several simultaneous changes destroy the result.
Do not repeatedly hard-crash an unstable PC to “see if it happens again.” Back up important data first. Avoid torture tests when the machine already loses power, overheats or shows signs of electrical damage. A repair shop with known-good parts and proper PSU test equipment can isolate hardware more safely.

What each restart pattern changes

PatternMoves up the listWhat it does not prove
Instant black screen and reboot under combined CPU/GPU loadPower delivery, PSU capacity or protection, GPU power path, heatThat the PSU is definitely faulty
Nonzero BugcheckCode or Event 1001The documented Stop-code branch and dump analysisThat every generic “Kernel 41 fix” applies
Stable at BIOS defaults, unstable with XMP/EXPO or undervoltLost tuning margin and memory or voltage stabilityThat the RAM module itself is defective
Restart only after temperatures and clocks deteriorateCooling, thermal or power limitsThat a faster component will solve it
Display black, audio continues, PC stays poweredGPU driver reset, display path or GPU stabilityThat the whole system lost power
Random restart at idle and loadMemory, board, firmware, power, driver or background failureThat the gaming workload caused it

Where PC Workman helps, and where it cannot

PC Workman can preserve the system context around the event: CPU and GPU load, memory, temperatures, clocks, power-related readings exposed by supported sensors and the active processes. That history can show whether the restart followed rising heat, falling clocks, memory pressure or a repeatable workload.

PC Workman does not analyze Windows crash dumps, decode WHEA records or electrically test a power supply. Software voltage values are not a substitute for proper measurement under load. It also cannot save a final sample after power has already disappeared. Use its timeline as one layer beside Event Viewer, Reliability Monitor, memory testing and physical inspection.

Short answers

Does Kernel-Power 41 mean the PSU is bad?

No. It means the previous shutdown was not clean. A PSU fault is one possible cause of an abrupt blackout, but the event does not identify the failed component.

Why did the PC restart without a blue screen?

Power may have vanished, the system may have hard-hung, or automatic restart may have hidden a Stop screen. Read the Event 41 fields, check Event 1001 and verify dump creation.

What should I check first?

Preserve the timestamp and fields, inspect the events immediately before the restart, check dumps, return tuning to default and log a small repeatable workload. Change one thing at a time.

Primary sources

Receipt PRO essay · silent failures The most dangerous bug does not crash. It succeeds. Six real failures that ran perfectly and did nothing, the week I let an assistant write more than I read, and the five checks that catch them. Read the essay →
Keep the minute before the restart. PC Workman records local system history so a sudden reboot is not reduced to one red Event Viewer line. Free and open source. Download for Windows.

If the machine remains on but the game only hitches, start with frame time and 1% lows →

MF

Marcin Firmuga

Developer of PC Workman · HCK_Labs

I write the diagnostic boundary into the guide: a sensor timeline can narrow the restart, but it cannot pretend to be a PSU tester or crash-dump debugger.