How to view Startup and Shutdown history in Windows

Sometimes you want to know the Shutdown and Startup history on your Windows PC. Especially System administrators need to know about the history for addressing troubleshooting issues. If multiple users uses the system, then it is must to check the startup and shutdown history for the good security measures and to make sure that the PC is being used legitimately.

Whatever may be the reason, here I am showing how to check the startup and shutdown times of a system. This can be checked using two ways, let us see what are they.

How to view Startup and Shutdown history in Windows

Using event logs

For this we will use Windows Event Viewer which is very good tool that saves all kinds of stuff happening on your PC. This Event Viewer is handled by an eventlog service which cannot be disabled manually. Event Viewer also logs the startup and shutdown times of the eventlog service.

  • First press Win+R keys to launch Runbox and enter eventvwr.msc. In case if you are using Windows 8 then launch Event Viewer by pressing WIN+X+V keys together.
    event_viewer
  • In the following window, select Windows Logs > System from the left pane.
  • Now in the right pane you will get the list of events that are occurred while Windows is running. As we want details of only three events, click on event ID label to sort the data.
    event_system
  • If the eventlog of your PC is very big, then sorting doesn’t work properly. It let you create a filter from the actions pane from the right hand side and click on Filter current log.
    event_filter
  • In the next window, enter 6995, 6006 in the Event sources box and specify the time period under logged.
    event_filter_properties

Event ID’s 6005 and 6006 are synonymous to System startup and shutdown respectively. If you want further details use EventID 6013 which is used to see uptime of computer, 6009 indicates processor information, 6008 will let you know that system started after it wasn’t started properly.

Using TunedOn Times View

TurnedOn Times View is the third party portable tool which is used for analyzing eventlog for startup and shutdown times on your computer. It help you to view the list of startup and shutdown history of local computers or any remote PC connected to the network. As it is the portable utility you need to just unzip and execute the file TurnedonTimesView.exe present inside the folder.

event_turnedonview

Then it will automatically display the shutdown and startup time, duration of the uptime between startup and shutdown time. It will also tell you the shutdown reason and shutdown code. Shutdown reason is generally associated with Windows server systems which were supposed to tell the reason, why it is shutting down.

To see the startup and shutdown history of the remote PC, just navigate to Options > advanced options and select Data Source as remote computer. Enter the name of the PC or IP address in Computer name field and hit on OK. This actions will display the details of the remote computer.

You may also like...