Event ID 4609SystemP3

Windows Event ID 4609: Windows is shutting down

Windows Security Event ID 4609 records Windows shutdown.

Applicable version: Windows Server 2008 and later where the audit subcategory is enabled
Last reviewed: 2026-07-13

Trigger Scenarios

Microsoft event monitoring guidance lists 4609 as Windows shutting down; use it with 4608 to bracket reboot activity.

Key Fields

EventID / TimeCreated

Shutdown timestamp for the audited system.

Computer

The host that is shutting down.

Pairing with 4608

A following 4608 indicates restart; absence can indicate extended downtime.

Common False Positives

Planned patching, maintenance, and operator-initiated reboots.
Power events and virtualization host operations can shut down guest systems normally.

Related Events

MITRE ATT&CK Mapping

T1529System Shutdown/Reboot

Detection Notes

Use threshold=1 unexpected 4609 on domain controllers, security servers, or production hosts outside maintenance windows. Microsoft monitoring guidance identifies 4609 as Windows shutting down; unexpected shutdown followed by 4608 startup can support T1529 System Shutdown/Reboot when paired with attacker activity, log clearing, or disabled services. Correlate TimeCreated with 1102, 4719, 5030/5035, and hypervisor or power-management records.

Microsoft Sentinel KQL

SecurityEvent
| where EventID == 4609
| project TimeGenerated, Computer

Splunk SPL

index=wineventlog EventCode=4609 | table _time, host

Sample Log

EventID: 4609
Computer: DC01
TimeCreated: 2026-07-13T03:09:00Z

Source

Official documentation Machine-readable JSON