Restart / Shutdown Event
Using Windows Event Viewer
Event ID 41 should say “The system has rebooted without shutting down first.” You’ll see this if your PC reboots without a proper shutdown.
Event ID 1074 may have varying messages depending on how the PC was shutdown. However, it always happens when a program or the user initiates a shutdown.
Event ID 1076 lets you know why the PC was shut down or restarted. It can give you more insight into why something happened.
Event ID 6005 should be labeled as “The event log service was started.” This is synonymous with system startup.
Event ID 6006 should be labeled as “The event log service was stopped.” This is synonymous with system shutdown.
Event ID 6008 should say “The previous system shutdown at [time] on [date] was unexpected.” This is a sign your PC started up after an improper shutdown.
Event ID 6009 has varying messages based on your processor. However, it means your processor was detected at a specific time.
Event ID 6013 should say “The system uptime is [time.]” This shows how long your PC’s been on. This is the time in seconds.
Using Command Prompt or Powershell
Press Win + R to open the Run dialog.
Type “cmd” and press Ctrl + Shift + Enter to open Command Prompt with elevated admin privileges.
Enter the following command and replace the Event ID number with the number you want to see. In this case, it’s “6006.”
wevtutil qe system "/q:*[System [(EventID=6006)]]" /rd:true /f:text /c:1
If you want to check out multiple codes at once, it’s easier to use PowerShell. Press Win + X and select “Terminal (Admin)” or “PowerShell (Admin)” depending on your version of Windows.
Enter the following command. Replace the numbers in the brackets to include any Event ID numbers you want
Get-EventLog -LogName System |? {$_.EventID -in (6005,6006,6008,6009,1074,1076)} | ft TimeGenerated,EventId,Message -AutoSize -wrap
Using TurnedOnTimesView
TurnedOnTimesView is a simple, portable tool for analyzing the event log for startup and shutdown history. The utility can be used to view the list of shutdown and startup times of local computers or any remote computer connected to the network. The utility works on any Windows version from Windows 2000 to Windows 10. That being said, it also functions well on Windows 11, as per our tests.
Since it is a portable tool, you will only need to unzip and execute the TurnedOnTimesView.exe file.
It will immediately list the startup time, shutdown time, duration of uptime between each startup and shutdown, shutdown reason, and shutdown code.
It will also display a “Shutdown Reason” which is usually associated with Windows Server machines where you have to give a reason if you are shutting down the server. If you have a non-server edition of Windows, you likely won’t see a “Shutdown Reason” listed.
Press F9 to go to “Advanced Options.”
Select “Remote Computer” under “Data Source.”
Specify the IP address or name of the computer in the “Computer Name” field and press the “OK” button. Now the list will show the details of the remote computer.
While you can always use the event viewer for detailed analysis of startup and shutdown times, TurnedOnTimesView serves the purpose with a very simple interface and to-the-point data.
If TurnedOnTimesView isn’t quite right for you, try LastActivityView. It comes from the same developers. Not only does it show the startup and shutdown activity, but shows if files and programs were opened, system crashes network connections/disconnections, and more. It’s a good way to see what happened during an unexpected system startup/shutdown if you’re working on a Windows 11/10/8/7/Vista computer.
Another option is Shutdown Logger, which is compatible with Windows 11/10/8/7 As the name implies, it tells you when your PC was shut down. However, it adds a few more nice features, including who was logged in before the shutdown and the PC uptime. It offers only a 30-day free trial, though.
REFERENCES
Last updated
Was this helpful?