How to view startup and shutdown history in Windows 10 Windows

Sometimes in the process of using a computer, you will need information such as system startup and shutdown history. For example, if you are a system administrator, the shutdown history data can play a useful role in troubleshooting procedures. Or sometimes you also want to know the system’s on and off history to see if your computer has been accessed illegally.

In this article, we will learn two ways to track Windows 10 PC startup and shutdown times correctly.

Use Event Viewer to extract startup and shutdown times

Windows Event Viewer is a great tool to help save all the activities that are happening on the computer. For each event that occurs on the system, the Event Viewer records an entry. Event Viewer is handled by the eventlog service, which cannot be stopped or turned off manually, as it is a core Windows service. In addition, Event Viewer will also log the startup and shutdown history of the eventlog service. Therefore, you can leverage this data to know when your computer is started or turned off.

Eventlog service events are logged with 2 event codes (Event IDs). ID 6005 indicates that the eventlog service has been started, while ID 6009 indicates that the eventlog service has been stopped. Take a look at the entire process of extracting this information from the Event Viewer.

1. Open Event Viewer (by pressing Win + CHEAP and enter keywords eventvwr).

2. Look in the left pane, open “Windows Logs -> System“.

4. If your event log is too large, sorting will not be available. You can now create a filter

task pane on the right side. Just click “Filter current log“.

5. Enter 6005, 6006 go to school Event ID labeled <All Event IDs>. You can also specify the time period in the Logged.

• Event ID 6005 will be labeled as “The event log service was started”. This means that a system boot session has been performed.
• Event ID 6006 will be labeled as “The event log service was stopped”, corresponding to a system shutdown.

If you want to dig deeper, you can take a look at Event ID 6013, which shows the computer’s uptime, and Event ID 6009, which shows processor information detected during boot time. Event ID 6008 will tell you that the system has started up after not being shut down properly.

Using the TurnedOnTimesView widget

TurnedOnTimesView is a simple tool that you can use to check startup and shutdown history. This utility can be used to view the list of shutdown and startup times of local computers or any remote computer connected to the network.

To use it, you will just need to extract and execute the TurnedOnTimesView.exe file. The application will immediately list you the startup time, shutdown time, the active time between each shutdown and shutdown, as well as the reason for shutdown.

To see the startup and shutdown times of a remote computer, navigate to “Options -> Advanced Options” and select “Data source as Remote Computer”. Specify the computer’s IP address or name in the Computer Name field, and then click OK. Immediately, there will be a list showing detailed information of the corresponding computer, including data on the time on and off as mentioned above.

While you can always use Event Viewer for detailed breakdown of startup and shutdown times, TurnedOnTimesView has the advantage of a very simple and exceptionally easy-to-use interface. Which method to use depends on your preference.