How To See Pc Startup And Shutdown History In Windows

Understanding the startup and shutdown history of your Windows computer can be crucial for troubleshooting, security, and general system maintenance. Here’s how you can access and analyze this information using built-in Windows tools.

Using Event Viewer to Extract Startup and Shutdown Times

The Event Viewer is a powerful tool in Windows that logs various system activities, including startup and shutdown events. Here’s how to use it:

1. Open Event Viewer:

   • Press the Windows logo + R keys to open the Run dialog.
   • Type eventvwr.msc and hit Enter.

2. Navigate to System Logs:

   • In the Event Viewer window, navigate to Windows Logs > System on the left pane.

3. Filter the Log:

• Click on Filter Current Log on the right side.
• In the filter dialog, type the following Event IDs into the textbox under Includes/Excludes Event IDs: 6005, 6006, 1074, 6008.
• Click OK to apply the filter.

Important Event IDs

• Event ID 6005: Indicates that the event log service was started, which is synonymous with system startup.
• Event ID 6006: Indicates that the event log service was stopped, which is synonymous with system shutdown.
• Event ID 1074: Records when a user or an application initiates a shutdown or restart.
• Event ID 6008: Logs when the system shuts down unexpectedly.
• Event ID 41: Indicates that the system rebooted without shutting down completely.

Using Command Prompt to View Startup and Shutdown Times

If you prefer using the Command Prompt, you can extract the startup and shutdown information using the following commands:

1. Open Command Prompt:

   • Press the Windows logo + R keys to open the Run dialog.
   • Type cmd and hit Enter.

2. Retrieve Shutdown and Startup Logs:

   • Use the following command to retrieve the last shutdown event:

     wevtutil qe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1
     

   • To view only the date and time of the last shutdown, use:
     bash wevtutil qe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1 | findstr /i "date" .

Alternative Tools for Viewing Startup and Shutdown History

TurnedOnTimesView

For a simpler and more user-friendly interface, you can use TurnedOnTimesView:

1. Download and Run TurnedOnTimesView:
   • Download the tool from a reliable source.
   • Run the tool, which will display a list of startup and shutdown times.

LastActivityView

Another tool from the same developers as TurnedOnTimesView is LastActivityView, which provides more detailed information:

1. Download and Run LastActivityView:
   • Download the tool from a reliable source.
   • Run the tool to see detailed logs of system activities, including startup and shutdown times, file and program usage, and network connections.

Shutdown Logger

Shutdown Logger is another option that provides additional features:

1. Download and Run Shutdown Logger:
   • Download the tool from a reliable source.
   • Run the tool to view detailed logs of shutdown times, including who was logged in before the shutdown and the PC uptime. Note that this tool offers only a 30-day free trial.

Using PowerShell to Get the Last Boot Time

For those comfortable with PowerShell, you can use the following command to get the last boot time:

1. Open PowerShell:

   • Press the Windows logo + R keys to open the Run dialog.
   • Type powershell and hit Enter.

2. Retrieve the Last Boot Time:

   • Use the following command:
     powershell Get-CimInstance -ClassName Win32_OperatingSystem | select csname, lastbootuptime .

This method provides a quick way to see the last boot time without navigating through the Event Viewer.