Windows Event ID 4609: Windows is shutting down
An event defined to represent “Windows is shutting down.” Note, however, that Microsoft’s documentation states this event is not actually generated (it is defined but not used by the OS).
Overview
The subcategory is Audit Security State Change. It is defined as the “shutdown” counterpart to 4608 (Windows is starting up). But Microsoft Learn explicitly notes that, although 4609 is defined, it is not actually recorded. As a result, trying to detect shutdown by 4609 in the Security log will miss it.
How to actually detect shutdown
Because 4609 cannot be relied on, capture shutdown / the stop of log collection with the following events.
- 1100 (The event logging service has shut down) — the legitimate stopping point where Security log collection ends. It is recorded at shutdown and works as the practical “stop event.”
- System log 6006 (the event log service was stopped) / 6008 (unexpected shutdown) — complement the trigger and health of the shutdown.
- The reappearance of 4608 (Windows is starting up) — indicates the next boot, so combined with the preceding gap in logs, you can estimate the down period.
Security review points
- Build the up/down timeline from 4608 and 1100 (plus System log 6006/6008). Do not depend on the presence of 4609.
- Unexpected shutdowns (6008), or restarts that lack a stop event, should be checked as possible crash-inducing actions or log evasion.
Notes for log review
- The “absence” of 4609 is not itself an anomaly (it is never generated in the first place). Base shutdown-detection rules on 1100 and the System log, not on 4609.
- Treat a gap in logs as the “down period” up to the reappearance of 4608, and reconstruct the sequence from other hosts or forwarded logs.
Key fields
It carries no specific data fields (and because it is not generated, you will almost never observe real data).