There are times when the user wants to know the start-up history of a Windows 10 computer. Typically, system administrators request this type of information for troubleshooting purposes.
To the ordinary everyday Windows 10 user, such information can be a good security measure to control the start-up and shutdown times of their computer, to make sure that its machine is used properly by the rest of the family. In this article we will discuss two ways you can see when your computer shut down and when it started.
Using the Event Viewer
Windows 10 event viewer is a wonderful tool which records and classifies all events that occur on the computer. It runs as a service named eventlog and cannot be stopped or disabled manually as it is a core Windows service.
Among the event logs he makes, he records the start and end times of the event logging service, ie himself. We can use these logs to get an idea of when our Windows 10 computer started or shut down.
The events concerning the service itself eventlog are recorded with two event codes. Event ID 6005 indicates that the eventlog service has started, and Event ID 6009 indicates that the eventlog event service has stopped. Let's look at the full process of extracting this information:
1. Open the Event Viewer. If you do not know how, press Ctrl + R at the same time and in the popup window that appears, type the word eventvwr and press the OK button.
2. In the left pane, open Windows Logs -> System.
3. In the middle part of the window you will see a list of events that happened while running Windows 10. You care to see only three events. So first sort the event log by event IDs. Do click in the “Event ID” label to sort the data relative to that column.
4. If the calendar events is huge, then sorting alone won't work. You can also create a filter from the action pane on the right side. Just click on “Filter current log file”.
Event ID 6005 will be marked as "Event logging service started". This is synonymous with booting the system.
Event ID 6006 will be marked as "Event logging service has stopped". This is synonymous with shutting down the system.
If you want to further explore the event log, you can go to event ID 6013 which will display the computer startup time and event ID 6009 indicates the processor information found at startup. Event ID 6008 will inform you that the system started while it did not close properly (if this ever happened to you).
Using TurnedOnTimesView
The TurnedOnTimesView is a simple, portable tool for Windows 10 that can be used to view a list of shutdown and startup times of local computers or any remote computer connected to the network.
Download, unzip and run TurnedOnTimesView.exe file. The start time, shutdown time, duration of operation time between each start and shutdown, the shutdown ratio and the shutdown code will be recorded immediately.
The reason for termination is usually associated with Windows Server machines, where you must enter a cause if you shut down the server.
To view the start-up and shutdown times of a remote computer, go to “Options -> Advanced Options” and select “Data source as Remote Computer". Specify the IP address or computer name in the Computer Name field and press the OK button. Now the remote computer details will appear in the list.
While you can always use the Windows 10 Event Viewer for detailed startup and shutdown analysis, TurnedOnTimesView shows you the same things with a very simple and understandable look.
