There are times when a user wants to know the startup and shutdown history of a computer. Mostly, system administrators need to know about the history for troubleshooting purposes. If multiple people use the computer, it may be a good security measure to check PC startup and shutdown times to make sure the PC is being used legitimately. In this article, we discuss ways to keep track of your PC shutdown and startup times.
Good to know: learn how to add portable apps to Windows startup by checking our guide.
1. Using Event Logs to Extract Startup and Shutdown Times
Windows’ built-in Event Viewer is a wonderful tool that saves all kinds of occurrences that are happening on the computer. During each event, Event Viewer logs an entry. This is all handled by the eventlog service that cannot be stopped or disabled manually, as it is a Windows core service. At the same time, Event Viewer logs the startup and shutdown history of the eventlog service. You can verify those times to get an idea of when your computer was started or shut down.
The eventlog service events are logged with two event codes. Event ID 6005 indicates that the eventlog service was started, and event ID 6006 indicates that the eventlog service was stopped. Let’s go through the complete process of extracting this information from Event Viewer.
- Open Event Viewer (press Win + R and type “eventvwr.”)
- In the left pane, open “Windows Logs -> System.”
- In the middle pane, you will get a list of events that occurred while Windows was running. Our goal is to see only three events. Let’s first sort the event log with “Event ID.” You can either left-click the “Event ID” column to auto-sort or right-click and select “Sort events by this column” to sort.
- If your event log is huge, then the sorting will not work. You can also create a filter from the actions pane on the right side. Just click on “Filter current log.”
- Type “6005, 6006” in the Event IDs field labeled as “<All Event IDs>.” You can also specify the time period under “Logged” (at the top.)
When you’re investigating, there are several important Event IDs to check out, including:
- Event ID 41 should say “The system has rebooted without shutting down first.” You’ll see this if your PC reboots without a proper shutdown.
- Event ID 1074 may have varying messages depending on how the PC was shutdown. However, it always happens when a program or the user initiates a shutdown.
- Event ID 1076 lets you know why the PC was shut down or restarted. It can give you more insight into why something happened.
- Event ID 6005 should be labeled as “The event log service was started.” This is synonymous with system startup.
- Event ID 6006 should be labeled as “The event log service was stopped.” This is synonymous with system shutdown.
- Event ID 6008 should say “The previous system shutdown at [time] on [date] was unexpected.” This is a sign your PC started up after an improper shutdown.
- Event ID 6009 has varying messages based on your processor. However, it means your processor was detected at a specific time.
- Event ID 6013 should say “The system uptime is [time.]” This shows how long your PC’s been on. This is the time in seconds.
You can also set up custom Event Viewer views to be able to check this information in the future quickly and save time. You can also set up multiple Event Viewer views based on your needs, not just the startup and shutdown history.
Tip: Not sure when you should be using Command Prompt over PowerShell or vice-versa? Check out the differences here.
2. Checking With Command Prompt or PowerShell
If you don’t want to go through all the steps above, try using Command Prompt or PowerShell to check Event IDs. You’ll need to know the ID number to do this.
- Press Win + R to open the Run dialog.
- Type “cmd” and press Ctrl + Shift + Enter to open Command Prompt with elevated admin privileges.
- Enter the following command and replace the Event ID number with the number you want to see. In this case, it’s “6006.”
wevtutil qe system "/q:*[System [(EventID=6006)]]" /rd:true /f:text /c:1
- If you want to check out multiple codes at once, it’s easier to use PowerShell. Press Win + X and select “Terminal (Admin)” or “PowerShell (Admin)” depending on your version of Windows.
- Enter the following command. Replace the numbers in the brackets to include any Event ID numbers you want.
Get-EventLog -LogName System |? {$_.EventID -in (6005,6006,6008,6009,1074,1076)} | ft TimeGenerated,EventId,Message -AutoSize -wrap
- It may take a minute for results to appear. However, you’ll notice it’s a lot more detailed than Command Prompt.
FYI: Need more info regarding Event Viewer? We show you how to use it in-depth.
3. Using TurnedOnTimesView
TurnedOnTimesView is a simple, portable tool for analyzing the event log for startup and shutdown history. The utility can be used to view the list of shutdown and startup times of local computers or any remote computer connected to the network. The utility works on any Windows version from Windows 2000 to Windows 10. That being said, it also functions well on Windows 11, as per our tests.
- Since it is a portable tool, you will only need to unzip and execute the TurnedOnTimesView.exe file.
- It will immediately list the startup time, shutdown time, duration of uptime between each startup and shutdown, shutdown reason, and shutdown code.
- It will also display a “Shutdown Reason” which is usually associated with Windows Server machines where you have to give a reason if you are shutting down the server. If you have a non-server edition of Windows, you likely won’t see a “Shutdown Reason” listed.
- Press F9 to go to “Advanced Options.”
- Select “Remote Computer” under “Data Source.”
- Specify the IP address or name of the computer in the “Computer Name” field and press the “OK” button. Now the list will show the details of the remote computer.
While you can always use the event viewer for detailed analysis of startup and shutdown times, TurnedOnTimesView serves the purpose with a very simple interface and to-the-point data.
If TurnedOnTimesView isn’t quite right for you, try LastActivityView. It comes from the same developers. Not only does it show the startup and shutdown activity, but shows if files and programs were opened, system crashes network connections/disconnections, and more. It’s a good way to see what happened during an unexpected system startup/shutdown if you’re working on a Windows 11/10/8/7/Vista computer.
Another option is Shutdown Logger, which is compatible with Windows 11/10/8/7 As the name implies, it tells you when your PC was shut down. However, it adds a few more nice features, including who was logged in before the shutdown and the PC uptime. It offers only a 30-day free trial, though.
Tip: there are many modes for putting your computer on pause. Check out the differences between shut down vs sleep vs hibernate to decide which is right for you.
Frequently Asked Questions
Why did my computer shut down unexpectedly?
If you know no one else was using your PC, an unexpected shutdown might be worrisome. You’ll usually see Event ID 6008 if this has happened.
While it’s not always a serious problem, the most common causes of unexpected shutdowns include your computer overheating, power issues, hard drive failures, and even driver issues.
Can I see how long I have used my computer?
You could use a third-party app like Shutdown Logger (mentioned earlier), or take advantage of Screen Time, which is a built-in feature of Windows. All you have to do is set up Microsoft Family using your Microsoft account. You can then add other users from your PC and see how you and others are using the PC. Go to “Settings -> Accounts -> Open Family App” to get started.
What should I do if I find a suspicious log in the Event Viewer?
If something seems a little fishy, it might be time to start digging deeper into suspicious startup and shutdown events. Use these tricks to see if someone else is logging into your computer.
Image credit: Pexels All screenshots by Crystal Crowder.
Our latest tutorials delivered straight to your inbox
