Skip to content

Event ID 18: The operating system is starting after soft restart

Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.

Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's security auditing reference.

Try: 4625, 4624, 4740, 6008, 41, 1074, 7045, 1102, 4104, 1149

The operating system is starting after soft restart.

Event 18
Kernel-General
System log
Information
Message and fields (as Event Viewer shows them) 
The operating system is starting after soft restart. BugcheckRecovery: …

There are … boot options on this system.

Event 18
Kernel-Boot
System log
Information
Message and fields (as Event Viewer shows them) 
There are … boot options on this system.

Installation Ready: The following updates are downloaded and ready for installation.

Event 18
WindowsUpdateClient
System log
Information
Message and fields (as Event Viewer shows them) 
Installation Ready: The following updates are downloaded and ready for installation. This computer is currently scheduled to install these updates on … at …: …

The time provider NtpClient failed to establish a trust relationship between this computer and the … domain in order to securely synchronize time.

Event 18
Time-Service
System log
Warning
Message and fields (as Event Viewer shows them) 
The time provider NtpClient failed to establish a trust relationship between this computer and the … domain in order to securely synchronize time. NtpClient will try again in … minutes. The error was: …

Adapter resource list failure

Event 18
StorPort
System log
Warning
Message and fields (as Event Viewer shows them) 
Adapter resource list failure

An error occurred while retrieving some provider parameter

Event 18
Security-Kerberos
System log
Information
Message and fields (as Event Viewer shows them) 
An error occurred while retrieving some provider parameter: …

Remote Desktop Service is shutdown for unknown reason.

Event 18
TerminalServices-LocalSessionManager
TerminalServices-LocalSessionManager/Operational log
Error
Message and fields (as Event Viewer shows them) 
Remote Desktop Service is shutdown for unknown reason. Will recover in one minute.

WMI Events were dropped.

Event 18
WMI-Activity
WMI-Activity/Operational log
Information
Message and fields (as Event Viewer shows them) 
WMI Events were dropped. ConsumerType = …; Possiblecause = …

SMB2 Request Query Directory

Event 18
SMBServer
SMBServer/Operational log
Information
Message and fields (as Event Viewer shows them) 
SMB2 Request Query Directory

The peer list rejected an incoming server announcement.

Event 18
Bits-Client
Bits-Client/Operational log
Warning
Message and fields (as Event Viewer shows them) 
The peer list rejected an incoming server announcement. This event is generated if the request is not valid, not if the server is merely in a different Windows domain.