Windows event codes for startup/shutdown lock/unlock

Refering to your request about starting and shutdown event IDs, I made the list below based on a Windows 10 machine. The main point is that depending on the shutdown action (planned reboot, planned shutdown, unexpected shutdown or LSASS process crash), the generated events will be differents:

• 1074 The process Explorer.EXE has initiated the shutdown of computer on behalf of user for the following reason: Other (Unplanned)
• 6006 The Event log service was stopped.
• 109 The kernel power manager has initiated a shutdown transition.
• 13 The operating system is shutting down at system time ‎
• 20 The last shutdown's success status was true. The last boot's success status was true.
• 12 The operating system started at system time
• 6005 The Event log service was started.
• 6013 The system uptime is 10 seconds.

To make a clear overview on those different shutdown actions, I made the following table. Hope it will help.