Skip to content

Event ID 13: The operating system is shutting down at system time

Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.

Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's security auditing reference.

Try: 4625, 4624, 4740, 6008, 41, 1074, 7045, 1102, 4104, 1149

The operating system is shutting down at system time

Event 13
Kernel-General
System log
Information
Message and fields (as Event Viewer shows them) 
The operating system is shutting down at system time ….

Element … of application … was not in policy.

Event 13
Kernel-Boot
System log
Warning
Message and fields (as Event Viewer shows them) 
Element … of application … was not in policy.

Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but the computer is joined to a Windows NT 4.0 domain.

Event 13
Time-Service
System log
Warning
Message and fields (as Event Viewer shows them) 
Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but the computer is joined to a Windows NT 4.0 domain. Windows NT 4.0 domain controllers do not have a time service and do not support domain hierarchy as a time source. NtpClient will attempt to use an alternate configured external time source if available. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.

NTFS KSR data filled successfully.

Event 13
Ntfs
System log
Information
Message and fields (as Event Viewer shows them) 
NTFS KSR data filled successfully.

           Volume GUID: …
           Device Name: …

           NTFS KSR version: …
           Number of runs filled: …
           Time to fill (ms): …

Miniport IO Request Service Time

Event 13
StorPort
System log
Information
Message and fields (as Event Viewer shows them) 
Miniport IO Request Service Time

The smart card PIN stored in Credential Manager is missing or invalid.

Event 13
Security-Kerberos
System log
Information
Message and fields (as Event Viewer shows them) 
The smart card PIN stored in Credential Manager is missing or invalid. The smart card PIN is stored in memory only for the current interactive logon session, and is deleted if the card is removed from the card reader or when the user logs off. To resolve this error, keep the card in the reader, open Credential Manager in Control Panel, and reenter the PIN for the credential ….

Stop OperationId = …; ResultCode

Event 13
WMI-Activity
WMI-Activity/Operational log
Information
Message and fields (as Event Viewer shows them) 
Stop OperationId = …; ResultCode = …

SMB2 Request Break Oplock

Event 13
SMBServer
SMBServer/Operational log
Information
Message and fields (as Event Viewer shows them) 
SMB2 Request Break Oplock

BITS started listening for peer-server announcements.

Event 13
Bits-Client
Bits-Client/Operational log
Information
Message and fields (as Event Viewer shows them) 
BITS started listening for peer-server announcements.