“The system administrator may need to find the startup and shutdown time for the Windows PC. If you are an administrator or just curious to see system startup and shutdown time log to troubleshoot or diagnose something on your PC, then this guide is for so continue reading. This guide is written using Windows 10 and 8.x, but I think this will work on Windows 7 as well.
See also: Find Windows Boot Duration
Find Windows PC Startup and Shutdown Time Logs
Windows Event Log Viewer utility saves all the logs related to Windows system, setup, security, application and more. So to find PC startup and shutdown log we need to open this Windows utility. You can open even log viewer using one of the following methods.
- Windows 7 user press Windows + R keys from the keyboard, type “
eventvwr.msc” in it and hit the Enter key.
- Windows 8.x users can use the above method, but they can also right-click at the Start button location and select “Event Viewer” from the menu.
- For Windows 10 the same above Win 8 method can be used for Wind 10.
Once you open the event viewer, here on the left-side expand the “Event Viewer” > “Windows log” and then select “System.” You will notice all system related event logs listed on the right-side. There will be thousands of events on the list, but we need only a few of them. We will search and filter Windows shutdown, and startup events log with their IDs.
Event IDs and their meanings
- Windows Start up time events logged under the Event ID 6005 and when your system start after unexpected shutdown information stored under ID 6008.
- Windows Shutdown time events logged under Event ID 6006.
- Another Event IDs that may helpful for you to troubleshoot/diagnose something on your Windows PC is 6013 which tells you Windows System uptime.
Find Windows Start and Shutdown Events log
Now let’s filter the Event IDs 6005 (Windows start up), 6006 (Windows shutdown) from Event Viewer so we can view required event logs to find Windows start and shutdown time.
When you select the System under Windows logs in the left-pane, click on the “Action” menu and then select “Filter Current Log…” option.
On the filter, events log window enter these two IDs 6005 and 6006 in Event IDs field by separating with a comma and click OK button.
When we apply a filter, this returns only 45 events related to shutdown and startup of the system. Which is easy to explore now. Sort this event list by Date and Time by clicking on the column title. Click on each event and see the related information in the panel below. As you can see we have selected one and below in event detail. It’s saying “The Event log service was started.” It means selected log is Windows Startup event. Event log details also showing date, time and some more information.
Similarly, you can filter the events by IDs and see other activities log information like system uptime and more. Before applying another filter make sure you clear the first one. To remove used filter right-click on the System in left-pane and select Clear Filter. Make sure you select clear filter not clear log.
Discuss with us below in comments if you need any help.
How can i know that which app was run after me in my pc
What I do understand you want to know what is happening on your computer when you absent, right?
the 6005,6006 no longer work corretly with win10. I shutdown every evening, but for the last 1.5 month I get 4 shutdown/restart
maybe someting to do with fast restart? It could be that I manualy restarted 4 times this month
Dont forget: Activate “Event level” – “Information” or all levels to get all events. No event level means no entry in the list.
An actually list of windows security events you can get here: https://download.microsoft.com/download/8/E/1/8E11AD26-98A1-4EE3-9F7F-1DB4EB18BADF/WindowsSecurityAuditEvents.xlsx
For example “4624,4634” for logon+logoff works fine.
4608+4609 for Windows start and shutdown dont work correctly on my Win10-64. I dont know why.
Does anybody know?