4 Ways to Check Startup and Shutdown History on Windows PC

Whether you’re a system administrator or trying to figure out how to fix a Windows problem, details about your system activity can significantly help you analyze the issue better. Consequently, your system’s startup and shutdown history can help you unravel underlying issues or identify what went wrong. Keeping this in mind, this article discusses several methods to check the startup and shutdown history on a Windows PC. Additionally, you can check the model and specs of your Windows laptop to learn more technical details about it.

How Windows Startup and Shutdown History Can Be Helpful?

A quick review of your Windows PC’s startup and shutdown history can help you answer questions such as why your system got shut down unexpectedly or when it was used recently. In addition, it can serve you with the following advantages:

Identify and fix existing system errors causing boot loops, crashes, and force shutdowns.
It can help you check the activity status for a certain time and whether you share it with other users.
It helps you ensure your system’s security.

Windows System Events Identifiers

Microsoft Windows stores all system activities in an event log, where an event ID represents each activity. To help you understand and identify these events better, have a look at these details:

Event ID 41: Indicates that your system rebooted without shutting down completely.
Event ID 1074: This event is logged when you initiate Shutdown using the Start Menu or an application force restarts/shuts down your Windows system.
Event ID 1076: Provides more details on why your system was shut down or restarted.
Event ID 6005: This event ID signifies a system startup.
Event ID 6006: This indicates that your system was shut down properly.
Event ID 6008: This event indicates that your system shut down unexpectedly.
Event ID 6013: Shows your system uptime (in seconds).

How to Check Startup and Shutdown History on Windows?

Now that you’re familiar with various system event IDs, let’s look at different methods to extract and check the startup/shutdown history on Windows.

Method 1 – Using Windows PowerShell

Windows PowerShell is a remarkable command-line tool for system administration. You can use it to extract EventID and all the necessary details for startup and shutdown to spot ongoing issues and system abnormalities. Here is what you need to do:

1. Press the Windows key and search for PowerShell to open it with administrative permissions.

2. Copy-Paste the following command and hit the Enter key.

Get-EventLog -LogName System |? {$_.EventID -in (6005,6006,6008,6009,1074,1076)} | ft TimeGenerated,EventId,Message -AutoSize -wrap

3. The following command will provide detailed information on the specified event codes, organized into three columns: Time Generated, EventID, and Message.

Method 2 – Using Command Prompt

Besides PowerShell, you can use the Command Prompt tool to check the most recent startup and shutdown history on Windows. This is helpful when you don’t wish to browse the entire log but only require the most recent activity.

1. Open the Command Prompt tool with elevated privileges.

2. Copy-Paste the following command and execute it with the Enter key.

wevtutil qe system “/q:*[System [(EventID=6006)]]” /rd:true /f:text /c:1

3. The tool will instantly show the most recent shutdown activity. To view the most recent startup activity, replace the EventID with 6005 in the above command and execute it.

Method 3 – Use the Windows Event Viewer Tool to Check the Startup and Shutdown History

The Event Viewer is a core part of Microsoft Windows that records every activity as a system log. Consequently, you can browse this log and filter the recorded results to check the startup and shutdown history. Here’s how it can be done:

1. Press the Windows key and open the Event Viewer tool as an administrator.

2. Expand Windows Logs from the left sidebar and double-click System to view associated logs.

3. Click Filter Current Log from the right sidebar.

4. Type 6005 and 6006 in the Event ID column and hit OK to view the startup and shutdown history, respectively.

5. Double-click an event log to view the associated details in the search result.

Method 4 – Using Free Third-Party Tools

In addition to native system tools, you can try several free third-party apps to check the startup and shutdown history on Windows. The TurnedOnTimesView and MyEventViewer from Nirsoft are two popular tools in the domain. Follow these steps to make the most out of them:

1. Download the TurnedOnTimesView app from Nirsoft and extract the downloaded package.

2. Double-click TurnedOnTimesView.exe in the extracted folder to launch the app.

3. It will show all startup and shutdown system logs in seconds.

4. Double-click the log file to view more details about it.

5. Similarly, you can download the MyEventViewer tool from Nirsoft for similar results.

6. You can also apply several EventType filters to the results to customize the system logs for easy viewing.

FAQs

Q. How to See My PC Startup and Shutdown History in Windows 10/11?

You can use EventViewer or Windows PowerShell to get a detailed history report of your system’s startup and shutdown process. In addition, free third-party tools like TurnedOnTimesView and MyEventViewer can also help you fetch the exact results.

Q. Why Did My Windows PC Shut Down Automatically?

There are numerous reasons behind a Windows PC shutting down automatically. It can be due to overheating, hardware, or a software glitch. Moreover, some apps force the restart on a Windows PC automatically after installation.

Q. How to Check When a Windows Computer Was Last Used?

You can use the command prompt to check the most recent use of your Windows PC. Replace the EventID with 6005 in the above-listed command and execute to view the most recent startup. Similarly, you can use Event ID 6006 to get details of the recent shutdown.

Q. How to Check Windows Reboot History Using Powershell?

Unlike Command Prompt, Windows PowerShell provides a detailed reboot history report instead of displaying the most recent one. Execute the following command to check the reboot history of Windows.

Get-EventLog -LogName System |? {$_.EventID -in (41,1074,1076)} | ft TimeGenerated,EventId,Message -AutoSize -wrap

Q. What Is the CMD Command to Check Windows Reboot History?

The CMD command to check the most recent startup/reboot history on Windows is:

wevtutil qe system “/q:*[System [(EventID=6005)]]” /rd:true /f:text /c:1

Q. What Are Various Windows Startup Event IDs?

Each event ID in Windows represents a specific activity. For example, Event ID 6005 indicates a system startup, while 6006 signifies that your system had a proper shutdown. For more details on Event IDs, check Identify System Events section listed above.

Final Words

This brings us to the end of this guide, where we discussed all the nifty methods to check the system’s startup and shutdown details on Windows. If you found it useful, spread the word with your friends and subscribe to GadgetsToUse for more interesting explainers. Meanwhile, don’t forget to check other help links related to Windows 11 and 10.

You might be looking for:

You can also follow us for instant tech news at Google News or for tips and tricks, smartphones & gadgets reviews, join GadgetsToUse Telegram Group, or for the latest review videos subscribe GadgetsToUse Youtube Channel.