An unexpected restart is a Windows crash that forces the system to reboot, sometimes showing a stop code or blue screen first. It usually means the operating system hit a fatal error it could not safely recover from. Common causes include faulty drivers, kernel bugs, firmware problems, corrupted system files, or failing hardware.
In cyber security, unexpected restarts matter because they can be symptoms of both ordinary instability and hostile activity. A crash may follow a bad update, but it can also appear after exploit attempts, malformed inputs, or malware that destabilizes the kernel or driver stack. Defenders use the restart event itself, stop codes, event logs, and memory dumps to separate software regressions from suspicious behavior. Repeated crashes on the same endpoint can also disrupt monitoring, block users, and create openings for follow-on attacks if systems are left unpatched or in recovery mode.