How to Find Windows Start Up and Shutdown Time Logs

System administrator may need to find the start up and shutdown time of the Windows PC. If you are an administrator or just curious to find system start up and shutdown time log to troubleshoot or diagnose something on your PC then this guide is for so continue reading. This guide is written using Windows 8.x screenshots but I think same thing will work on Windows 7 as well.

See also : Find Windows Boot Duration


Find Windows PC Start up and Shutdown Time Logs

Windows Event Log Viewer utility saves all the logs related to Windows system, setup, security, application and more. So to find PC start up and shutdown log we need to open this Windows utility. You can open even log viewer using one of the following method.

Windows 7 user press Windows + R keys from keyboard, type eventvwr.msc in it and hit the Enter key.

Windows 8.x users can use the above method but they can also right-click at the Start button location and select “Event Viewer” from the menu.

Once you open the even viewer, here on the left-side expand the “Event Viewer” > “Windows log” and then select “System”. You will notice all system related event logs will be listed on the right-side. There will be thousands of events in the list but we need only few of them. We will search Windows shutdown and startup events log by their IDs.


Event IDs and their meanings

  • Windows Start up time events logged under the Event ID 6005 and when your system start after unexpected shutdown information stored under ID 6008.
  • Windows Shutdown time events are logged under Event ID 6006.
  • Another Event IDs that may helpful for you to troubleshoot/diagnose something on your Windows PC is 6013 which tells you Windows System uptime.

Find Windows Start and Shutdown Events log

Now lets filter the Event IDs 6005 (Windows start up), 6006 (Windows shutdown) from Event Viewer so we can view required event logs to find Windows start and shutdown time.

When you select the System under Windows logs in the left-pane, click on the “Action” menu and then select “Filter Current Log…” option.


On the filter events log window enter these two IDs 6005 and 6006 in Event IDs field by separating with comma and click OK button.


When we apply filter this returns only 45 events related to shutdown and start of system, which is easy to explore now. Sort this event list by Date and Time by clicking on the column title then Click on each event and see the related information in the panel below, as you can see we select one event and below in event detail its saying “The Event log service was started.” It means its windows Start up event and also showing date, time and some more event log detail.


In the Similar way you can filter the events by IDs and see other events log information like system uptime and more… before applying another filter make sure you clear the first one. To clear applied filter right-click on the System in left-pane and select “Clear Filter”, make sure you select clear filter not clear log.

Discuss with us below in comments if you need any help.

3 comments… add one
urooz khan May 6, 2014, 10:01 am

How can i know that which app was run after me in my pc

TrickyWays May 10, 2014, 12:04 am

What I do understand you want to know what is happening on your computer when you absent, right?

Leave a Reply