A customer laptop has been shutting down unexpectedly.

A blue screen or sudden shutdown generates diagnostic records that persist after reboot, and the primary Windows tool to review those records is Event Viewer . Quentin Docter states: “ Event Viewer should be the first place you look when you are trying to solve a problem whose solution is not evident ,” because the system and applications “will often create an entry… that can be used to… diagnose problems.” He also specifically notes for unexpected shutdowns: “ The first place to check is Event Viewer on the System tab ,” where kernel and EventLog entries help determine whether the system lost power or shut down abnormally.

Mike Meyers reinforces that Event Viewer is how you read Windows logs (Application, Security, Setup, System) and that the details pane shows information about the selected event, which is exactly what you need when the on-screen error flashes too quickly. Performance Monitor is for counters/trends, Device Manager focuses on hardware status/drivers, and System Information shows configuration—not the crash/shutdown event details. Hence, Event Viewer (C) is correct.