How to Check Your Startup and Shutdown History in Windows

Xiaobai Software  2022-04-24 11: 25  read 221 views

Sometimes you may need to know the history of when your computer was started or shut down; for example, if you are a system administrator, or if you share your computer with your friends or family.You can use this history to troubleshoot errors within your system and make sure your computer isn't being accessed outside of the allowed time.

Fortunately, there are quite a few ways to check the Windows startup and shutdown history.Next, we will detail the three most effective methods for you:

1. Using the Event Viewer

Windows Event Viewer is an administrative-level tool that displays a small number of logs, including error messages, events, warnings, and other extra information about your operating system processes.

Every program that starts on the computer publishes a notification to the event log, and every program that is running normally publishes a notification before it shuts down.An event log is created each time a system access occurs, a security change occurs, a bug causes an error, or a driver failure occurs.

In this method, we will use the Event Viewer tool to view your startup and shutdown history in Windows.This program will display at least the following five related events.

1. Event ID 41 - This event is logged when you restart your computer without shutting down completely.

2. Event ID 1074 - This event is logged in two cases: one is through the shutdown command of the Start menu, and the other is when an application causes the computer to restart or shut down.

3. Event ID 6005 - It means the system starts up.This event is created when the event log service starts.

4. Event ID 6006 - This event is logged with a proper shutdown.

5. Event ID 6008 - This event will be logged if your computer shuts down unexpectedly.For example, if you shut down the computer directly with the power button, or if the system encounters an error that causes the computer to shut down immediately.

Now that we know the events that show startup and shutdown information, let's see how to view these logs in Event Viewer:

1. Press Win + R to open the Run dialog.

2. Type eventvwr in the text field of the dialog box and press Enter.This will launch the event viewer.

3. Expand the Windows Logs section from the left pane and select System.


4. Select Filter Current Log from the left pane.


5. Now, under "Include/Exclude Event IDs" enter the event IDs you want to check.Since we want to check the startup and shutdown logs, we will enter IDs 6005 and 6006.


6. Click "OK" to continue.


The Event Viewer should now display a list of shutdown and startup events.

2. Use Command Prompt

If the first method is a bit time consuming for you, you can use the command prompt to do the same thing, which will greatly reduce your processing time.

Command Prompt is another administrative-level utility used to execute entered commands and perform advanced operations such as managing the network and troubleshooting.In this method, we will execute the command using the preferred event ID in the event viewer.Methods as below:

1. Press Win + R to open the Run dialog.

2. Enter cmd in the text field of the dialog and press Ctrl + Shift + Enter at the same time.This will launch a "Command Prompt" with administrative privileges.

3. Once you are in the command prompt d prompt, enter the command mentioned below to view your shutdown history.If you want to see the history of something else, you can replace the event ID with another ID.

wevtutil qe system "/q:*[System [(EventID=6006)]]" /rd:true /f:text /c:1

4. If you just want to see the date and time of the event, execute the following command:
wevtutil qe system "/q:*[System [(EventID=6006)]]" /rd:true /f:text /c:1 | findstr /i "date"

3. Use third-party tools

Alternatively, you can use third-party tools to do the same job.In this method, we'll make use of TurnedOnTimesView, a handy tool similar to the Windows Event Viewer.It records information about each startup and shutdown, including its time and type (mandatory, normal).In addition, you can obtain this information for local and remote computers on the network.

This tool is ideal for those looking for a quick read of data without scrolling through the long list of event data displayed by the Event Viewer.

AccessTurnedOnTimesViewdownload page and download the app.The download link is far down the page, so keep scrolling until you see it.

2. Once the file is downloaded, go to File Explorer to extract it.

3. Run the unzipped file.

4. Navigate to the Options tab and select Advanced Options.


5. Select a data source according to your preference.If you selected the "Remote Computer" option, enter the computer name and click "OK".


The tool will now display the startup and shutdown history of your Windows operating system.

Track your computer's startup and shutdown history

If you want to check when your computer was last used, the methods listed above should help you find this information.Knowing how to track startup and shutdown times will help in situations where you share your computer with other family members or friends.

Address of this article:
Copyright Notice:The article only represents the author's point of view, the copyright belongs to the original author, welcome to share this article, please keep the source for reprinting!