There are times when the user wants to know the startup and shutdown history of a Windows 10 computer. Typically, system administrators request this type information in order to solve problems.
To the ordinary everyday Windows 10 user, such information can be a good security measure to control the start-up and shutdown times of their computer, to make sure that its machine is used properly by the rest of the family. In this article we will discuss two ways you can see when your computer shut down and when it started.
Using the Event Viewer
Windows 10 Event Viewer is a great tool that records and sorts everything that happens on your computer. It works as a service called eventlog and cannot be stopped or disabled manually, as it is a basic Windows service.
Among the event logs he makes, he records the start and end times of the event logging service, ie himself. We can use these logs to get an idea of when our Windows 10 computer started or shut down.
The events concerning the service itself eventlog are logged with two event codes. Event ID 6005 indicates that the eventlog service has started, and event ID 6009 indicates that the eventlog event service has stopped. Let us see the complete process of Eqtreatmentof this information:
1. Open the Event Viewer. If you do not know how, press Ctrl + R at the same time and in the popup window that appears, type the word eventvwr and press the OK button.
2. In the left pane, open Windows Logs -> System.
3. In the middle part of the window you will see a list of events that happened while running Windows 10. You care to see only three events. So first sort the event log by event IDs. Do click in the “Event ID” label to sort the data relative to that column.
4. If the event log is huge, then sorting alone will not work. You can also create a filter from the action window on the right. Just click on "Filter current log".
5. Πληκτρολογήστε 6005, 6006 (μαζί με το κόμμα και το κενό) στο πεδίο Αναγνωριστικά συμβάντων με την ένδειξη . Μπορείτε επίσης να καθορίσετε την χρονική περίοδο στο πεδίο “καταγράφηκε” που από προεπιλογή είναι στο “Οποτεδήποτε”.
Event ID 6005 will be marked as "Event logging service started". This is synonymous with booting the system.
Event ID 6006 will be marked as "Event logging service has stopped". This is synonymous with shutting down the system.
If you want to further explore the event log, you can go to event ID 6013 which will display the computer startup time and event ID 6009 indicates the processor information found at startup. Event ID 6008 will inform you that the system started while it did not close properly (if this ever happened to you).
Using TurnedOnTimesView
The TurnedOnTimesView is a simple, portable tool for Windows 10 that can be used to view a list of shutdown and startup times of local computers or any remote computer connected to the network.
Download it, extract it and run the TurnedOnTimesView.exe file. The startup time, shutdown time, length of time between each startup and shutdown, reason for shutdown, and the code shutdown.
The reason for termination is usually associated with Windows Server machines, where you must enter a cause if you shut down the server.
To view the startup and shutdown times of a remote computer, go to “Options -> Advanced Options” and select “Data source as Remote Computer". Specify the IP address or computer name in the Computer Name field and press the OK button. Now the remote computer details will appear in the list.
While you can always use the Windows 10 Event Viewer for detailed startup and shutdown analysis, TurnedOnTimesView shows you the same things with a very simple and understandable look.
