Skip to content

Est. 2011·Microsoft Partner 7033487·Delivery under 3 min·Support 7 days a week

Your vault is empty.

License Error Event ID 1074

Event ID 1074 and 6008: separating an expired Server evaluation from a crash

12 min read Updated October 4, 2026 Windows Server: RDS, Hyper-V & Clustering

Fix it now

A server that keeps restarting is either being shut down deliberately by something, or crashing. Microsoft publishes Event ID 1074 as an application or a user initiating the shutdown, and Event ID 6008 as an improper or dirty shutdown. They point at opposite causes, so read which one you actually have before converting anything.

Run these in an elevated Command Prompt to see what the installation is and what it may become

DISM /online /Get-CurrentEdition
DISM /online /Get-TargetEditions
  1. In Event Viewer, Windows Logs, System, find the restarts. A 1074 naming a process on each cycle means something is asking for the restart. A 6008 with no 1074 means the machine went down unexpectedly, and this is a crash or a power problem rather than a licence.
  2. If 1074 names a person, a backup agent, a UPS service or an update orchestrator, stop here: that is your answer and no licence changes it.
  3. If the installation is an evaluation, read what it can become from Get-TargetEditions before you buy a key. A Standard evaluation converts to retail Standard or Datacenter; a Datacenter evaluation converts only to Datacenter.
  4. Convert with the key: DISM /online /Set-Edition:<target edition> /ProductKey:<key> /AcceptEula. Save the licence terms first with /GetEula:C:\license.rtf if you want them on record.
  5. If the server is an Active Directory domain controller, stop. Microsoft states an AD domain controller cannot be converted from evaluation to retail, and the route is a new controller on a licensed build.

Conversion is one way and it needs a restart. Take a backup or a checkpoint first, because re-running the command with a different key does not undo it.

If the restarts stop and the edition reads as you intended, you are done. If they continue, the next section separates the licensing case from the several other things that restart a server on a cycle.

Why it happens

Two event IDs do most of the work here and they mean opposite things. Microsoft publishes Event ID 1074 as being logged when an application is responsible for the system shutdown or restart, and also when a user restarts or shuts down from the Start menu or with Ctrl+Alt+Del. Event ID 6008 is published as an improper or dirty shutdown, logged when the most recent shutdown was unexpected. Event ID 6006 is the clean counterpart: Windows was adequately turned off.

So the pair tells you which world you are in. A repeating 1074 that names a process, followed by a 6006, is a machine being shut down deliberately, over and over, by something you can identify. A 6008 with no preceding 1074 is a machine that fell over. Those need entirely different work, and an article that treats 1074 and 6008 as one signature will send half its readers to buy a licence for a hardware fault.

When it is licensing, the underlying fact is straightforward. Microsoft states that the Windows Server 2025 evaluation edition expires in 180 days, and that evaluation versions must be activated over the internet in the first 10 days to avoid automatic shutdown. Those are two separate causes with the same symptom. A server built six months ago has run out of evaluation. A server built last week that never reached the internet has failed the activation requirement, and buying a key for that one is solving a problem it does not have yet.

Conversion is done with DISM rather than by installing a key, because an evaluation is a different edition of Windows rather than an unactivated copy of the licensed one. DISM /online /Set-Edition changes the edition and applies the key in one operation, and there are documented limits on where it can go.

The evaluation period has run out

You have this one if The installation reports an evaluation edition, and the restarts began roughly six months after the server was built.

  1. Confirm what you have: DISM /online /Get-CurrentEdition.
  2. Confirm what it may become: DISM /online /Get-TargetEditions. If your intended edition is not listed, the command will not do it.
  3. Obtain a key for that edition, then run DISM /online /Set-Edition:<target> /ProductKey:<key> /AcceptEula and let it complete without interruption.
  4. Restart when prompted and re-run DISM /online /Get-CurrentEdition to confirm the edition actually changed.

An evaluation of Standard can become retail Standard or retail Datacenter. An evaluation of Datacenter can become only Datacenter. There is no downgrade path.

The evaluation was never activated

You have this one if A recently built evaluation server, no internet access during or after the build, and shutdowns that started far sooner than six months.

  1. Check when the server was built against Microsoft’s stated requirement: evaluation versions must be activated over the internet in the first 10 days to avoid automatic shutdown.
  2. Give the server the outbound access it needs and let activation complete.
  3. Only if activation cannot be made to work, or the evaluation is genuinely finished, move on to conversion.
  4. Do not buy a key on the strength of the shutdowns alone; confirm which of the two you are in first.

This is the case that gets misdiagnosed most expensively, because the symptom is identical to expiry and the remedy is free.

Something else is restarting the server

You have this one if The installation is a licensed retail or volume edition, and the restarts still happen on a cycle.

  1. Read the process named in each 1074 entry. Backup agents, UPS software, monitoring tools and update orchestration all restart servers.
  2. Check Task Scheduler for a task with a restart action.
  3. If activation has lapsed on a licensed installation, re-activate rather than converting, and check the server can reach its activation source.
  4. If nothing is named and you see 6008 with no 1074 at all, investigate hardware and power rather than licensing.

The machine is crashing, not shutting down

You have this one if Event ID 6008 on every cycle with no 1074 and no 6006 before it, and sometimes a Kernel-Power entry as well.

  1. Take the published meaning seriously: 6008 is an improper or dirty shutdown, logged when the most recent shutdown was unexpected. Nothing asked politely.
  2. Look for the Kernel-Power critical entry that records a reboot without a clean shutdown first.
  3. Check the power supply, the power settings and, on a virtual machine, the host and its storage.
  4. Do not convert an edition or buy a key on this evidence. It will not stop.

Full reference

Reading the shutdown pattern

What the log shows What Microsoft publishes about it What that makes it
1074 on each cycle, naming a process Logged when an application is responsible for the shutdown or restart Something is asking. Identify it before doing anything else
1074 naming a person or a management tool The same event also covers a user shutting down from Start or Ctrl+Alt+Del Not a licence problem
6006 after the 1074 Windows was adequately turned off An orderly shutdown, which is what a deliberate one looks like
6008 with no 1074 or 6006 An improper or dirty shutdown; the most recent shutdown was unexpected A crash or a power loss
Kernel-Power Event ID 41 The system rebooted without cleanly shutting down first The same conclusion from a different source
A licensed edition in Get-CurrentEdition – Look elsewhere: this is not an evaluation problem

What the evaluation actually commits you to

  • Microsoft states the Windows Server 2025 evaluation edition expires in 180 days.
  • Microsoft states that evaluation versions of Windows Server must be activated over the internet in the first 10 days to avoid automatic shutdown. That is a separate obligation from the 180 days and it catches newly built servers.
  • Microsoft does not publish the interval between the shutdowns that follow, so treat the cadence you are seeing as your symptom rather than as your diagnosis. Confirm the licence state before acting on the timing.
  • When the evaluation is finished, Microsoft’s documented route is conversion to retail rather than reinstallation.

The conversion commands, and the limits on them

Command What it does
DISM /online /Get-CurrentEdition Reports the edition currently installed
DISM /online /Get-TargetEditions Reports the editions this installation may be converted to
DISM /online /Set-Edition:<target> /GetEula:C:\license.rtf Saves the licence terms for the target edition to a file
DISM /online /Set-Edition:<target> /ProductKey:<key> /AcceptEula Performs the conversion and applies the key
From To Allowed?
Standard evaluation Retail Standard Yes
Standard evaluation Retail Datacenter Yes
Datacenter evaluation Retail Datacenter Yes
Datacenter evaluation Retail Standard No
Any evaluation on a domain controller Any retail edition No: build a new DC on a licensed edition instead
Desktop Experience evaluation A Core retail version No, since Windows Server 2016

Edition conversion is one way and requires a restart. It cannot be undone by re-running the command with a different key. Take a backup or a virtual machine checkpoint before you start, and remember that a server shutting itself down gives you a limited window in which to finish.

Windows Server Essentials

Windows Server Essentials is the exception to the DISM route. Microsoft documents converting it with slmgr.vbs /ipk <license key> rather than with DISM /Set-Edition. If you are on Essentials and the Set-Edition command is refusing you, that is why.

Three event IDs in this article that Microsoft does not publish

Event ID 1073, Event ID 1076 and Event ID 6005 are all quoted routinely in shutdown troubleshooting and none of them has a published meaning that this article could find. They are in the codes table below marked as such. Read them on the server if they appear: they carry their own text. The diagnosis above is built on 1074, 6006 and 6008, which are published, and those three are enough to tell a deliberate shutdown from a crash.

When a licence is the actual fix

When an evaluation has genuinely expired, the licence is the fix and nothing else will do: the conversion command needs a key for an edition that DISM /online /Get-TargetEditions lists as available. Confirm two things before you buy. First, that the server is not simply an evaluation that was never activated within its first ten days, because that costs nothing to put right. Second, which edition your installation is allowed to become, because a Datacenter evaluation cannot be converted down to Standard and buying a Standard key for one wastes the money. Arco supplies Windows Server 2025 Standard licensing and will check both of those with you first. Two things worth settling in the same conversation: server licensing is counted by physical cores with minimums per processor and per server, so the licence has to match the hardware you actually have; and Client Access Licences for the users or devices that connect are a separate purchase from the server licence itself.

Every code this article covers

Code What it points at Source
Event ID 1074 Logged when an application is responsible for the system shutdown or restart, and when a user shuts down from the Start menu or with Ctrl+Alt+Del Microsoft Learn
Event ID 1076 Quoted in shutdown troubleshooting as the reason supplied after an unexpected shutdown. Microsoft publishes no meaning for it; read the entry itself not published by the vendor
Event ID 1073 Quoted as an attempted shutdown that did not complete. No published meaning found, so treat it as a pointer rather than a diagnosis not published by the vendor
Event ID 6008 An improper or dirty shutdown. Logged when the most recent shutdown was unexpected, which is evidence against a deliberate licensing shutdown Microsoft Learn
Event ID 6006 Indicates that Windows was adequately turned off: the marker of an orderly shutdown Microsoft Learn
Event ID 6005 The counterpart people pair with 6006 at boot time. No published meaning found; read 6006 and 6008 for the shutdown state instead not published by the vendor

Confirm the fix worked

  1. Run DISM /online /Get-CurrentEdition and confirm the edition is the licensed one you intended.
  2. Leave the server running well past the interval at which it was restarting and confirm no new Event ID 1074 appears.
  3. Confirm the System log shows no new 6008 either, so you know you fixed the right one of the two problems.
  4. Confirm the evaluation watermark is gone after a restart.
  5. If you converted a server that was also failing activation, confirm it can reach its activation source so it does not lapse again.

Questions people ask about this

My server logs 6008 every time. Is that the evaluation?

Probably not. Microsoft publishes 6008 as an improper or dirty shutdown, logged when the most recent shutdown was unexpected. A shutdown ordered by software is an orderly one and shows as 1074 followed by 6006. A repeating 6008 with no 1074 points at a crash or a power problem, and no licence fixes that.

How long does a Windows Server 2025 evaluation last?

Microsoft states the evaluation edition expires in 180 days. Separately, it states that evaluation versions must be activated over the internet in the first 10 days to avoid automatic shutdown, which is a different deadline and catches newly built servers.

Will converting the edition wipe my data or roles?

No. It is an in-place edition change and installed roles, data and configuration stay where they are. Take a backup anyway, because it is a one-way operation that cannot be reversed by running the command again.

Can I convert a Datacenter evaluation down to Standard to save money?

No. Microsoft states that a Datacenter evaluation can be converted only to retail Datacenter, not to retail Standard. If you want Standard, the server has to be rebuilt from Standard media.

My evaluation server is a domain controller. What are my options?

Conversion is not one of them: Microsoft states an AD domain controller cannot be converted from evaluation to retail. Build a new domain controller on a licensed edition, promote it, move any operations master roles, confirm replication, then demote the evaluation server.

Related error codes

Was this article helpful?

Your feedback helps us improve our documentation.

Related articles

Free Fix Event ID 15005 and 0x00000204: RD Gateway cannot bind port 443 for clients License Error Event ID 20499: RDS logons hang for minutes loading the user configuration Free Fix Event ID 55 and 137: NTFS corruption appears on SAN and iSCSI volumes Free Fix RD Gateway error 0x00000904 and 0x00000103: tunnel dies before the desktop
← Back to Knowledge Base