Sometimes you may need to know when a computer booted up or shut down history; for instance, if you're a system administrator or you share your computer with your friends or family members. You can use this history to troubleshoot errors within the system and make sure that your computer was not accessed out of the allowed hours.

Fortunately, there are quite a few ways to check the startup and shutdown history in Windows. Below we have discussed the three most effective methods of doing so in detail.

1. Use the Event Viewer

The Windows Event Viewer is an administrative-level tool that displays a handful of logs including error messages, events, warnings, and other additional information about the processes of your operating system.

Each program that starts on your computer posts a notification to the Event Log, and so does every healthy program before closing. Event Logs are created every time system access takes place, a security change occurs, a bug causes an error, or a driver malfunction arises.

In this method, we will be using the Event Viewer utility to view your startup and shutdown history in Windows. This program display at least five such relevant events which are as follows:

  • Event ID 41 - this event is logged when you reboot your PC without shutting it down completely.
  • Event ID 1074 - this event is logged in two situations: either by a shutdown command from the Start menu or when an application causes the computer to restart or shutdown.
  • Event ID 6005- it indicates system startup. This event is created when the Event log service starts.
  • Event ID 6006 - this event is recorded in a case of a proper shutdown.
  • Event ID 6008 - this event is logged if your computer shuts down unexpectedly. As an example, if you shut down the PC using the power button directly or if the system encounters an error, causing the computer to shut down immediately.

Now that we know about the events that display startup and shutdown information, let's see how we can view these logs in the Event Viewer:

  1. Press Win + R to open a Run dialog.
  2. Type eventvwr in the text field of the dialog box and hit Enter. This will launch the Event Viewer.
  3. Expand the Windows Logs section from the left pane and select System.
    Windows Logs in the Event Viewer
  4. Choose Filter current log from the left pane.
    Filter current log
  5. Now, type the event ID that you wish to check under Includes/Excludes Event IDs. Since we want to check the startup and shutdown logs, we will enter the IDs 6005 and 6006.
    Event IDs 6005 6006
  6. Click OK to proceed.
    Event IDs 6005 6006

The Event Viewer should now display a list of your shutdown and startup events.

2. Use Command Prompt

In the event that the first method is a bit time-consuming for you, you can execute the same operation using the Command Prompt, which will require much less processing time.

Command Prompt is another administrative-level utility that is used to execute entered commands and perform advanced operations like managing networks and troubleshooting problems. In this method, we will execute commands with our preferred event IDs from the Event Viewer.

Here is what you need to do:

  1. Press Win + R to open a Run dialog.
  2. Type cmd in the text field of the dialog and press Ctrl + Shift + Enter simultaneously. This will launch the Command Prompt with administrative privileges.
  3. Once you are inside the Command Prompt, type the command mentioned below to view your shutdown history. If you want to view the history of something else, you can replace the Event ID with another ID. 
    wevtutil qe system "/q:*[System [(EventID=6006)]]" /rd:true /f:text /c:1
    wevtutil command
  4. If you just want to view the date and time of the event, execute the following command: 
    wevtutil qe system "/q:*[System [(EventID=6006)]]" /rd:true /f:text /c:1 | findstr /i "date"
    wevtutil command

3. Use a Third-Party Tool

Alternatively, you can also use a third-party tool for the same job. In this method, we'll utilize TurnedOnTimesView, a convenient tool that is similar to the Windows Event Viewer. It records information about every startup and shutdown, including its timing and type (forced, normal). Moreover, you can get this information for both local and remote computers on your network.

This tool is ideal for those seeking a quick read of data without scrolling through long lists of event data displayed by the Event Viewer. Here is how you can use it:

  1. Visit the TurnedOnTimesView download page and download the app. At the time of writing, the download link is quite far down the page, so keep scrolling until you see it.
  2. Once the file is downloaded, head over to the File Explorer and extract it.
  3. Run the extracted file.
  4. Navigate to the Options tab and select Advanced Options.
    Turnedontimesview options
  5. Choose a data source according to your preferences. If you are choosing the Remote Computer option, then enter the computer name and hit OK.
    Data source

The tool will now display the startup and shutdown history on your Windows operating system.

Track Your PC's Startup and Shutdown History

If you ever wish to check when your PC was last used, the methods listed above should help you find this information. Knowing how to track the startup and shutdown timings can be helpful in situations where you share your computer with other family members or friends.