$start = [datetime]'2026-05-14 18:00:00'
$end   = [datetime]'2026-05-15 00:00:00'

# Shutdown/crash/service events
$evts = Get-WinEvent -LogName System -MaxEvents 5000 -ErrorAction SilentlyContinue |
  Where-Object { $_.TimeCreated -gt $start -and $_.TimeCreated -lt $end }

Write-Host "Total events in window: $($evts.Count)"

# Events we care about
$ids = @(1074,6006,6008,6009,41,7034,7035,7036)
$relevant = $evts | Where-Object { $_.Id -in $ids }

foreach ($e in ($relevant | Sort-Object TimeCreated)) {
    $ts = $e.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss')
    $msg = ($e.Message -split "`n")[0] -replace '\s+',' '
    Write-Host "$ts  ID=$($e.Id)  $msg"
}