Windows Filter Shutdown and Restart entries from Event Viewer Open Event Viewer (eventvwr.msc), goto Windows Logs, System. Right-click System, Filter Current Log. Filter on “41,1074,6006,6008”. That’s it.