Restart / Shutdown Event
Using Windows Event Viewer
Event ID 41 should say “The system has rebooted without shutting down first.” You’ll see this if your PC reboots without a proper shutdown.
Event ID 1074 may have varying messages depending on how the PC was shutdown. However, it always happens when a program or the user initiates a shutdown.
Event ID 1076 lets you know why the PC was shut down or restarted. It can give you more insight into why something happened.
Event ID 6005 should be labeled as “The event log service was started.” This is synonymous with system startup.
Event ID 6006 should be labeled as “The event log service was stopped.” This is synonymous with system shutdown.
Event ID 6008 should say “The previous system shutdown at [time] on [date] was unexpected.” This is a sign your PC started up after an improper shutdown.
Event ID 6009 has varying messages based on your processor. However, it means your processor was detected at a specific time.
Event ID 6013 should say “The system uptime is [time.]” This shows how long your PC’s been on. This is the time in seconds.
Using Command Prompt or Powershell
Press Win + R to open the Run dialog.
Type “cmd” and press Ctrl + Shift + Enter to open Command Prompt with elevated admin privileges.
Enter the following command and replace the Event ID number with the number you want to see. In this case, it’s “6006.”
If you want to check out multiple codes at once, it’s easier to use PowerShell. Press Win + X and select “Terminal (Admin)” or “PowerShell (Admin)” depending on your version of Windows.
Enter the following command. Replace the numbers in the brackets to include any Event ID numbers you want
Using TurnedOnTimesView
Since it is a portable tool, you will only need to unzip and execute the TurnedOnTimesView.exe file.
It will immediately list the startup time, shutdown time, duration of uptime between each startup and shutdown, shutdown reason, and shutdown code.
It will also display a “Shutdown Reason” which is usually associated with Windows Server machines where you have to give a reason if you are shutting down the server. If you have a non-server edition of Windows, you likely won’t see a “Shutdown Reason” listed.
Press F9 to go to “Advanced Options.”
Select “Remote Computer” under “Data Source.”
Specify the IP address or name of the computer in the “Computer Name” field and press the “OK” button. Now the list will show the details of the remote computer.
While you can always use the event viewer for detailed analysis of startup and shutdown times, TurnedOnTimesView serves the purpose with a very simple interface and to-the-point data.
REFERENCES
Last updated
Was this helpful?
