How to Check Startup and Shutdown History in Windows

This article talks about ways to keep Check Startup and Shutdown History in Windows. There are times when a user wants to know how often a computer has been turned on and off in the past. Most of the time, system administrators need to know about the past to figure out what’s wrong.

If more than one person uses the computer, it might be a good idea to check the start-up and shut-down times to make sure that the computer is being used properly. If you are a system administrator or just share your computer with other people, you may need to know when the computer was last turned on and off.

There are ways to get around the fact that Windows doesn’t show the history at the top of the screen. There are many reasons why you might want to look at the history of when a computer started up or shut down. You can also go to the official Microsoft support site to know more information.

Ways to Check Startup and Shutdown History in Windows

Use Command Prompt

If you find that the first method takes too much time, you can do the same thing with the Command Prompt, which will take much less time to process.

Command Prompt is another tool for administrators that is used to run commands and do more complicated tasks like managing networks and fixing problems. In this method, we will use the Event Viewer to get the event IDs we want to use to run commands. What you have to do is:

• Press Win + R to open a Run dialog.
• Type cmd in the text field of the dialog and press Ctrl + Shift + Enter simultaneously. This will launch the Command Prompt with administrative privileges.
• Once you are inside the Command Prompt, type the command mentioned below to view your shutdown history. If you want to view the history of something else, you can replace the Event ID with another ID.

wevtutil qe system "/q:*[System [(EventID=6006)]]" /rd:true /f:text /c:1

• If you just want to view the date and time of the event, execute the following command:

wevtutil qe system "/q:*[System [(EventID=6006)]]" /rd:true /f:text /c:1 | findstr /i "date"

Use the Event Viewer

The Windows Event Viewer is a tool for system administrators that shows error messages, events, warnings, and other information about how your operating system is running.

Every time a program starts on your computer, it sends a message to the Event Log. The same is true for every healthy program before it shuts down. Event Logs are made whenever there is access to the system, a change in security, a bug that causes an error, or a driver that doesn’t work right.

In this method, we’ll use the Windows tool Event Viewer to look at your history of starting up and shutting down. This program shows at least five of these important events, which are:

• Event ID 41 – this event is logged when you reboot your PC without shutting it down completely.
• Event ID 1074 – this event is logged in two situations: either by a shutdown command from the Start menu or when an application causes the computer to restart or shutdown.
• Event ID 6005– it indicates system startup. This event is created when the Event log service starts.
• Event ID 6006 – this event is recorded in a case of a proper shutdown.
• Event ID 6008 – this event is logged if your computer shuts down unexpectedly. As an example, if you shut down the PC using the power button directly or if the system encounters an error, causing the computer to shut down immediately.

Now that we know about the events that show information about starting up and shutting down, let’s look at how to see these logs in the Event Viewer:

1. Press Win + R to open a Run dialog.
2. Type eventvwr in the text field of the dialog box and hit Enter. This will launch the Event Viewer.
3. Expand the Windows Logs section from the left pane and select System.
4. Choose Filter current log from the left pane.
5. Now, type the event ID that you wish to check under Includes/Excludes Event IDs. Since we want to check the startup and shutdown logs, we will enter the IDs 6005 and 6006.
6. Click OK to proceed.

Use a Third-Party Tool

You can also use a tool from a third party to do the same job. In this method, we’ll use TurnedOnTimesView, a handy tool that is similar to the Windows Event Viewer. It keeps track of every start-up and shut-down, including the time and type of each one (forced, normal).

You can also get this information for computers on your network that are both nearby and far away. This tool is great for people who want to read data quickly without having to scroll through long lists of events in the Event Viewer. Here’s how it can be used:

1. Visit the TurnedOnTimesView download page and download the app. At the time of writing, the download link is quite far down the page, so keep scrolling until you see it.
2. Once the file is downloaded, head over to the File Explorer and extract it.
3. Run the extracted file.
4. Navigate to the Options tab and select Advanced Options.
5. Choose a data source according to your preferences. If you are choosing the Remote Computer option, then enter the computer name and hit OK.