How to see your computer’s startup and shutdown history in Windows 10
Sometimes the user wants to know the startup and shutdown history of the computer. In most cases, administrators need to know the history for troubleshooting. If your computer is used by more than one person, it may be helpful to check the computer’s startup and shutdown times to ensure that the computer is being used legally. In this article, we discuss two ways to monitor computer downtime and startup time.
Use event logs to extract start and stop times
Windows Event Viewer is a great tool that records all kinds of things that happen on your computer. The event viewer saves a note for each event. The Event Viewer is managed by an event log service that cannot be stopped or disabled manually because it is the core service of Windows. Event Viewer also saves the start and stop history of the Eventlog service. You can use these times to get an idea of when your computer turned on or off.
Eventlog events are logged with two event codes. Event ID 6005 indicates that the event log service has started, and event ID 6009 indicates that the event log services have been stopped. We go through the whole process of extracting this information from the event viewer.
1. Open Event Viewer (press Win + R and type
2. Open “Windows Logs -> System” in the left pane.
3. In the middle pane, you will see a list of events that occurred while Windows was running. Our concern is to see only three events. Let’s start by sorting the event log by event ID. Click the Event ID label to sort the data by the Event ID column.
4. If the event log is huge, sorting will not work. You can also create a filter from the action pane on the right. Just click “Filter Current Log”.
5. In the Event ID field, type 6005, 6006 . You can also set the time in Combined.
- Event ID 6005 is marked “Event log service started”. This is synonymous with booting the system.
- Event ID 6006 is marked “Event log service stopped”. This is synonymous with shutting down the system.
If you want to dig deeper into the event log, you can go through event ID 6013, which shows computer uptime, and event ID 6009 displays processor information detected during startup. Event ID 6008 indicates that the system has booted after it was not successfully shut down.
You can also configure custom event views to display only this information in the future. This saves time and allows you to set up custom views for the events you want. You can configure multiple Event Viewer views to suit your needs, not just your start and end history.
Show activation times is a simple and portable tool for analyzing event logs for start and stop history. The utility can display a list of shutdown and startup times for local computers or any remote computer connected to the network. Because this is a portable tool, all you need to do is extract and run the TurnedOnTimesView.exe file. It immediately lists the start time, stop time, duration of availability between each start and stop, the reason for the stop, and the stop code.
The reason for closing is usually related to Windows Server machines, for which we have to give a reason if we close the server.
To view the start and stop times of a remote computer, select “Settings -> Advanced” and select “Data source as remote computer”. Enter the IP address or computer name in the Computer Name field and press OK. Now the list shows the information of the remote computer.
While you can still use the Event Viewer for detailed analysis of startup and shutdown times, TurnedOnTimesView serves this purpose with a very simple interface and accurate data. What do you monitor your computer’s startup and shutdown times? Which selection method do you prefer?
Do you suspect that someone else is logging on to your computer? Find out how you can find out who used your computer while you were away. The methods above can also give you a hint that someone might be using your computer without your permission.