There are times when the user wants to know the startup and shutdown history of one Windows 10 computer. Typically, system administrators request this type of information for troubleshooting purposes.
To the ordinary everyday Windows 10 user, such information can be a good security measure to control the start-up and shutdown times of their computer, to make sure that its machine is used properly by the rest of the family. In this article we will discuss two ways you can see when your computer shut down and when it started.
Using the Event Viewer
Windows 10 Event Viewer is a great tool that records and sorts everything that happens on your computer. It works as a service called eventlog and cannot be stopped or disabled manually, as it is a basic Windows service.
Among the event logs he makes, he records the start and end times of the event logging service, ie himself. We can use these logs to get an idea of when our Windows 10 computer started or shut down.
The events concerning the service itself eventlog are logged with two event codes. Event ID 6005 indicates that the eventlog service has started, and event ID 6009 indicates that the eventlog event service has stopped. Let us see the complete process of Eqtreatmentof this information:
1. Open Event Viewer. If you don't know how, press the Ctrl + R keys at the same time and in the window implementations that will appear type the word eventvwr and press the OK button.
2. In the left pane, open Windows Logs -> System.
3. A list of events that occurred while running Windows 10 will appear in the middle of the window. Your only concern is to see only three events. To do this, first sort the event log based on the event IDs. Click the "Event ID" tab to sort the data in relation to this column.
4. If the event log is huge, then sorting alone will not work. You can also create a filter from the action window on the right. Just click on "Filter current log".
5. Type 6005, 6006 (with comma and space) in the Event IDs field labeled . You can also specify the time period in the “recorded” field which by default is “Anytime”.
Event ID 6005 will be marked as "Event logging service started". This is synonymous with booting the system.
Event ID 6006 will be marked as "Event logging service has stopped". This is synonymous with shutting down the system.
If you want to further explore the event log, you can go to event ID 6013 which will display the computer startup time and event ID 6009 indicates the processor information found at startup. Event ID 6008 will inform you that the system started while it did not close properly (if this ever happened to you).
Using TurnedOnTimesView
The TurnedOnTimesView is a simple, portable tool for Windows 10 that can be used to view a list of shutdown and startup times of local computers or any remote computer connected to the network.
Download, unzip and run TurnedOnTimesView.exe file. The start time, shutdown time, duration of operation time between each start and shutdown, the shutdown ratio and the shutdown code will be recorded immediately.
The reason for termination is usually associated with Windows Server machines, where you must enter a cause if you shut down the server.
To view the startup and shutdown times of a remote computer, go to “Options -> Advanced Options” and select “Data source as Remote Computer". Specify the IP address or computer name in the Computer Name field and press the OK button. Now the remote computer details will appear in the list.
While you can always use the Windows 10 Event Viewer for detailed startup and shutdown analysis, TurnedOnTimesView shows you the same things with a very simple and understandable look.
