История выключения компьютера windows 10

Windows сохраняет информацию о различных системных событиях в системных журналах, с помощью которой можно определить время включения и выключения компьютера. Если вам требуется получить эту информацию, сделать это можно несколькими несложными способами.

В этой инструкции подробно о том, как посмотреть время, когда компьютер включался и когда выключался как средствами системы, так и с помощью сторонних инструментов.

Просмотр событий Windows

Первая возможность — посмотреть соответствующие события вручную, с помощью утилиты «Просмотр событий», встроенной в Windows, для этого достаточно использовать следующие шаги:

Нажмите клавиши Win+R на клавиатуре (в Windows 11 и Windows 10 можно нажать правой кнопкой мыши по кнопке «Пуск» и выбрать пункт «Выполнить»), введите eventvwr.msc и нажмите Enter.
В открывшемся окне просмотра событий в панели слева выберите «Журналы Windows» — «Система».
Используйте сортировку по столбцу «Код события», либо настройте фильтр журнала (в панели справа) с указанием кодов событий 6005 (запуск) и 6006 (остановка), при необходимости — даты и времени события (при клике по заголовку столбца «Дата и время» вы можете отсортировать события по значениям в этом столбце).

Картинка с сайта: remontka.pro
Вы увидите список событий, когда компьютер включался и выключался (есть нюансы, о которых далее).

Картинка с сайта: remontka.pro

События с указанными кодами не указывают напрямую на включение компьютера и завершение работы, а записываются в момент запуска и остановки службы журнала событий, но поскольку при штатной работе запуск и остановка происходят при включении и выключении соответственно — эту информацию можно использовать для получения требуемых сведений. Однако, в случае, например, загрузки компьютера с флешки, события записаны не будут.

Некоторые другие коды событий, имеющие отношение к включению, выключению и перезагрузке:

41 — перезагрузка или выключение без правильного завершения работы.
1074 — при инициации завершения работы или перезагрузки какой-либо программой.
6008 — при неправильном выключении компьютера.

Получение информации в командной строке и PowerShell

Информацию о времени событий с кодами 6005 (обычно соответствует времени запуска) и 6006 (завершения работы) можно получить с помощью командной строки или PowerShell.

В первом случае: запустите командную строку от имени администратора, а затем используйте команду

wevtutil qe system "/q:*[System [(EventID=6005)]]" /rd:true /f:text /c:1

Последнее число в команде указывает на то, сколько последних событий с указанным кодом (6005 в примере) следует отобразить.

Посмотреть время включения и выключения компьютера в командной строке

В PowerShell от имени администратора можно использовать следующую команду:

Get-EventLog -LogName System |? {$_.EventID -in (6005,6006)} | ft TimeGenerated,EventId,Message -AutoSize -wrap

При выполнении этой команды вы получите список всех событий с указанными кодами, датой и временем.

Время включения и выключения компьютера в PowerShell

Бесплатная утилита TurnedOnTimesView

Если вы предпочитаете использовать простые приложения, показывающие нужные сведения, время включения и выключения компьютера можно посмотреть в с помощью программы TurnedOnTimesView, доступной бесплатно на официальном сайте разработчика.

Достаточно скачать утилиту, запустить её и получить нужную информацию в удобной таблице, где показаны:

Дата и время включения (Startup Time)
Дата и время выключения (Shutdown Time)
Продолжительность работы (Duration)
Причина выключения
Тип выключения

И некоторые другие сведения, имеющие отношение к включению ПК и завершению работы.

Программа позволяет получить сведения о включении и выключении не только для локального компьютера, но и для компьютеров в локальной сети — соответствующие настройки можно найти в параметрах программы:

Кстати, у того же разработчика есть ещё одна программа — LastActivityView, которая покажет не только время включения и выключения, но и события, связанные с запуском программ, сбоями, запуском EXE-файлов (с указанием этих файлов), подключением к сети и другие.

Источник

Table of contents

What Is the Windows Event Viewer?
Most Common Windows Reboot and Shutdown Event IDs
How to See PC Startup and Shutdown Logs in Windows 10/11?
- Method 1: View the shutdown and restart log from the Event Viewer
- Method 2: View the shutdown and restart log using the Command Prompt
Windows Restart/Shutdown Logs: Explained
FAQ

Are you wondering what happens when your computer shuts down and after it restarts? Many things happen within that period, and thankfully, Windows helps track the entire process and keeps a record in the system log.With the built-in Windows Event Viewer, you can monitor the activities that occur on your computer before, during, and after it shuts down or restarts. In this article, we’ll teach you how to do that, but first, what is the Event Viewer?

What Is the Windows Event Viewer?

The Event Viewer

records application and system messages on a Windows 10 PC and logs every action taken while working on the computer. That said, if many users operate a computer, you can use the Event Viewer to monitor each user’s activities while the device is running. Also, it helps users discover errors, such as blue screens of death (BSODs) , information messages, and warnings on their PCs. What’s more, you can’t alter, stop, or disable the activities of the Event Viewer altogether because it’s a core Windows service. In many cases, you can start troubleshooting any issue on a Windows computer from the Event Viewer. However, as a rule of thumb, you don’t need to panic even if there are alarming messages or warnings in the system log. Unfortunately, some fraudsters take advantage of messages in the Event Viewer to scare and defraud people. They can manipulate it to display error messages and warnings even if your computer is working correctly. Without much ado, let’s show you how to track what happens when your computer shuts down or starts using the Windows Event Viewer or the Command Prompt.

Most Common Windows Reboot and Shutdown Event IDs

There are many identified events related to shutting down and restarting a PC. However, we will show you the most common four in this article, and they include the following:

Event ID 41: This Event Viewer restart event ID shows that your Windows computer didn’t shut down completely and restarted .
Event ID 1074: When a certain app forces your laptop or PC to shut down or restart, you’ll see this shutdown/ restart event ID reflected in the Windows restart log . It will also show you if the PC was shut down (or restarted) using the Ctrl + Alt + Del combo or directly from the Start menu .
Event ID 6006: This one is the Event Viewer shutdown event ID that shows that your PC shut down properly .
Event ID 6008: You will see this event in your Windows shutdown log if your PC shut down unexpectedly.

How to See PC Startup and Shutdown Logs in Windows 10/11?

Using the Windows Event Viewer, you can quickly determine the shutdown or reboot event IDs on your computer after shutting down or restarting. You can also access some of the events using the Command Prompt, as we will show you below.

Generally, there are two methods to check the reboot or shutdown event ID s on your computer. The steps for both methods to view the Windows shutdown log (or the restart one) on Windows 10 and 11 are absolutely the same.

Method 1: View the shutdown and restart log from the Event Viewer

Follow the steps below to view shutdown and restart activities using Event Viewer:

Press the Windows logo + R keys to invoke the Run dialog.
Type eventvwr.msc and hit Enter.

The Event Viewer window will open. After that, navigate to Windows Logs > System on the left pane.
Click on Filter Current Log on the right.

The Event Viewer window will open. After that, navigate to Windows Logs > System on the left pane. Click on Filter Current Log on the right.» src=»https://www.auslogics.com/en/articles/wp-content/uploads/2024/08/View-the-shutdown-2.png»></p>
<div class=

Картинка с сайта: www.auslogics.com

Type 41,1074,6006,6008 into the textbox under Includes/Excludes Event IDs , and then click OK to filter the event log to the desired shutdown/ reboot event ID s.

Type 41,1074,6006,6008 into the textbox under Includes/Excludes Event IDs, and then click OK to filter the event log to the desired shutdown/reboot event IDs.

After completing all the steps, the Event Viewer will only display the Windows shutdown log .

Important!

From the Windows 10 Fall Creators Update ( also known as version 1709 ), the OS can automatically reopen apps that were running before your computer shut down or restarted.

This information is handy for Windows users who upgraded their OS to the recent release.

You can avoid this Windows update issue by doing the following:

Adding a unique Shut Down context menu to the desktop to restore the classic behavior.
Seeing the last shutdown time using the Command Prompt .

Also read:A Problem Has Been Detected and Windows Has Been Shut Down

PRO TIP

We always advise people to use our recognized software tool to get rid of all sorts of computer problems. Auslogics BoostSpeed can remove all harmful files in the registry, tweak system settings to boost your computer’s speed and performance, and modify internet connection settings to ensure seamless browsing, quicker downloads, and better audio/video call quality.

Method 2: View the shutdown and restart log using the Command Prompt

If the first method is not convenient for you, you can use the Command Prompt to check the Windows restart log (or the shutdown one if that’s your case) by following the steps below:

Press the Windows logo + R keys to open the run dialog, and then type cmd . That’s how you open the Command Prompt.

Now, you can simply copy and paste (or type it yourself if you’re feeling like it) the code you see below into the Command Prompt window and press Enter:

wevtutil qe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1

Copy and paste the code you see below into the Command Prompt window and press Enter.

If you don’t need the complete Windows restart log with the reboot/ shutdown event ID and other information and want to view only the date and time of the last shutdown, you can use the code below:

wevtutil qe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1 | findstr /i "date"

That’s all! You can use the Command Prompt to view the Windows shutdown and startup log on Windows 10 and 11. However, I recommend using the Event Viewer, mainly because it’s simple and straightforward. Moreover, you don’t have to copy-paste codes, which fraudsters can take advantage of to hack into your computer.

Are you unable to view the restart and shutdown log on your Windows 10 /11 PC?

If you have computer issues like junk or corrupted files or registry keys, it may be challenging to get to see the Windows restart log (or the shutdown one) and view restart and shutdown events on your PC.

Windows Restart/Shutdown Logs: Explained

If you still can’t get to see the Windows shutdown log to view startup and shutdown events on your computer using the methods we have shared, please provide us with more details.

We’d also love it if you left a comment and shared our post on your social media. For more tips about Windows-related issues, visit our blog.

FAQ

It could be due to junk files, corrupted system files, or problematic registry keys. In such a case, I suggest that you run Auslogics BoostSpeed, which can help clear out these problems and allow you to view the logs properly.

That’s pretty straightforward. Follow these steps:

Right-click anywhere on your desktop and select New > Shortcut .
For a shutdown shortcut, type shutdown /s /f /t 0 in the location box.
For a restart shortcut, type shutdown /r /f /t 0 .
Click Next, name your shortcut (e.g., “Shutdown” or “Restart”), and click Finish.

If your computer is stuck in a restart loop , try booting into Safe Mode:

Restart your computer and press the F8 key (or Shift + F8) before the Windows logo appears to enter the Advanced Boot Options.
Select Safe Mode and press Enter.
Once in Safe Mode, use the System Restore feature or uninstall recently installed updates or drivers that you suspect might be causing the issue.

If you’re still stuck, you might need to use a bootable USB to repair your Windows installation.

To turn off Fast Startup :

Open Control Panel and navigate to Hardware and Sound > Power Options .
Click on Choose what the power buttons do on the left.
Click on Change settings that are currently unavailable .
Under Shutdown settings , uncheck the box next to Turn on fast startup (recommended) .
Click Save changes.

Follow these steps:

Press the Windows logo + R keys, type cmd , and hit Enter to open the Command Prompt.
Copy and paste the following command and press Enter:

wevtutil qe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1 | findstr /i "dat e"

Источник

If you are curious to know why your computer shut down and what happened exactly during the shut down, you will be happy to know that Windows is able to track the shut down process and write a number of events in the system log. In this article, we will see how to find them.

As the OS is using the default log format, all the events related to the shut down can be viewed with the built-in Event Viewer tool. No other third-party tools are required.

In Windows 10, there are three events connected with shut down and restart.

Event ID 1074 — Indicates that the shut down process was initiated by an app. For example, it can be Windows Update.

Event ID 6006 — The clean shut down event. This means Windows 10 was turned off correctly.

Event ID 6008 — Indicates a dirty/improper shutdown. Appears in the log when the previous shutdown was unexpected, e.g. due to power loss or BSoD (Bug check).

Here is how to find these events.

To find the Shutdown log in Windows 10, do the following.

Press the Win + R keys together on the keyboard to open the Run dialog, type eventvwr.msc, and press the Enter key.

Картинка с сайта: winaero.com
In Event Viewer, select Windows Logs -> System on the left.
On the right, click on the link Filter Current Log.

Картинка с сайта: winaero.com
In the next dialog, type the line 1074, 6006, 6008 into the text box under Includes/Excludes Event IDs.

Картинка с сайта: winaero.com
Click OK to filter the event log.

Now, the Event Viewer will display only events related to shut down.

Note: Starting with Windows 10 Fall Creators Update, the operating system is able to automatically reopen apps which were running before shutdown or restart. This behavior is totally unexpected for most Windows users who upgraded to the recent release of the OS. To avoid this issue, you can add a special «Shut Down» context menu to the Desktop that restores the classic behavior.

See the following article:

Add Shutdown Context Menu in Windows 10

That’s it.

Support us

Winaero greatly relies on your support. You can help the site keep bringing you interesting and useful content and software by using these options:

If you like this article, please share it using the buttons below. It won’t take a lot from you, but it will help us grow. Thanks for your support!

Источник

Quick Answer

Whether you’re a system administrator or trying to figure out how to fix a Windows problem, details about your system activity can significantly help you analyze the issue better.
A quick review of your Windows PC’s startup and shutdown history can help you answer questions such as why your system got shut down unexpectedly or when it was used recently.
Type 6005 and 6006 in the Event ID column and hit OK to view the startup and shutdown history, respectively.

Whether you’re a system administrator or trying to figure out how to fix a Windows problem, details about your system activity can significantly help you analyze the issue better. Consequently, your system’s startup and shutdown history can help you unravel underlying issues or identify what went wrong. Keeping this in mind, this article discusses several methods to check the startup and shutdown history on a Windows PC. Additionally, you can check the model and specs of your Windows laptop to learn more technical details about it.

check Windows Startup and Shutdown History

How Windows Startup and Shutdown History Can Be Helpful?

A quick review of your Windows PC’s startup and shutdown history can help you answer questions such as why your system got shut down unexpectedly or when it was used recently. In addition, it can serve you with the following advantages:

Identify and fix existing system errors causing boot loops, crashes, and force shutdowns.
It can help you check the activity status for a certain time and whether you share it with other users.
It helps you ensure your system’s security.

Windows System Events Identifiers

Microsoft Windows stores all system activities in an event log, where an event ID represents each activity. To help you understand and identify these events better, have a look at these details:

Event ID 41: Indicates that your system rebooted without shutting down completely.
Event ID 1074: This event is logged when you initiate Shutdown using the Start Menu or an application force restarts/shuts down your Windows system.
Event ID 1076: Provides more details on why your system was shut down or restarted.
Event ID 6005: This event ID signifies a system startup.
Event ID 6006: This indicates that your system was shut down properly.
Event ID 6008: This event indicates that your system shut down unexpectedly.
Event ID 6013: Shows your system uptime (in seconds).

How to Check Startup and Shutdown History on Windows?

Now that you’re familiar with various system event IDs, let’s look at different methods to extract and check the startup/shutdown history on Windows.

Method 1 – Using Windows PowerShell

Windows PowerShell is a remarkable command-line tool for system administration. You can use it to extract EventID and all the necessary details for startup and shutdown to spot ongoing issues and system abnormalities. Here is what you need to do:

1. Press the Windows key and search for PowerShell to open it with administrative permissions.

2. Copy-Paste the following command and hit the Enter key.

Get-EventLog -LogName System |? {$_.EventID -in (6005,6006,6008,6009,1074,1076)} | ft TimeGenerated,EventId,Message -AutoSize -wrap

3. The following command will provide detailed information on the specified event codes, organized into three columns: Time Generated, EventID, and Message.

check Windows Startup and Shutdown History using PowerShell

Method 2 – Using Command Prompt

Besides PowerShell, you can use the Command Prompt tool to check the most recent startup and shutdown history on Windows. This is helpful when you don’t wish to browse the entire log but only require the most recent activity.

1. Open the Command Prompt tool with elevated privileges.

2. Copy-Paste the following command and execute it with the Enter key.

wevtutil qe system “/q:*[System [(EventID=6006)]]” /rd:true /f:text /c:1

check Windows Startup and Shutdown History using CMD

3. The tool will instantly show the most recent shutdown activity. To view the most recent startup activity, replace the EventID with 6005 in the above command and execute it.

Method 3 – Use the Windows Event Viewer Tool to Check the Startup and Shutdown History

The Event Viewer is a core part of Microsoft Windows that records every activity as a system log. Consequently, you can browse this log and filter the recorded results to check the startup and shutdown history. Here’s how it can be done:

1. Press the Windows key and open the Event Viewer tool as an administrator.

2. Expand Windows Logs from the left sidebar and double-click System to view associated logs.

3. Click Filter Current Log from the right sidebar.

check Windows Startup and Shutdown History using windows event viewer

4. Type 6005 and 6006 in the Event ID column and hit OK to view the startup and shutdown history, respectively.

5. Double-click an event log to view the associated details in the search result.

Method 4 – Using Free Third-Party Tools

In addition to native system tools, you can try several free third-party apps to check the startup and shutdown history on Windows. The TurnedOnTimesView and MyEventViewer from Nirsoft are two popular tools in the domain. Follow these steps to make the most out of them:

1. Download the TurnedOnTimesView app from Nirsoft and extract the downloaded package.

check Windows Startup and Shutdown History using third party tools

2. Double-click TurnedOnTimesView.exe in the extracted folder to launch the app.

3. It will show all startup and shutdown system logs in seconds.

4. Double-click the log file to view more details about it.

5. Similarly, you can download the MyEventViewer tool from Nirsoft for similar results.

6. You can also apply several EventType filters to the results to customize the system logs for easy viewing.

FAQs

Q. How to See My PC Startup and Shutdown History in Windows 10/11?

You can use EventViewer or Windows PowerShell to get a detailed history report of your system’s startup and shutdown process. In addition, free third-party tools like TurnedOnTimesView and MyEventViewer can also help you fetch the exact results.

Q. Why Did My Windows PC Shut Down Automatically?

There are numerous reasons behind a Windows PC shutting down automatically. It can be due to overheating, hardware, or a software glitch. Moreover, some apps force the restart on a Windows PC automatically after installation.

Q. How to Check When a Windows Computer Was Last Used?

You can use the command prompt to check the most recent use of your Windows PC. Replace the EventID with 6005 in the above-listed command and execute to view the most recent startup. Similarly, you can use Event ID 6006 to get details of the recent shutdown.

Q. How to Check Windows Reboot History Using Powershell?

Unlike Command Prompt, Windows PowerShell provides a detailed reboot history report instead of displaying the most recent one. Execute the following command to check the reboot history of Windows.

Get-EventLog -LogName System |? {$_.EventID -in (41,1074,1076)} | ft TimeGenerated,EventId,Message -AutoSize -wrap

Q. What Is the CMD Command to Check Windows Reboot History?

The CMD command to check the most recent startup/reboot history on Windows is:

wevtutil qe system “/q:*[System [(EventID=6005)]]” /rd:true /f:text /c:1

Q. What Are Various Windows Startup Event IDs?

Each event ID in Windows represents a specific activity. For example, Event ID 6005 indicates a system startup, while 6006 signifies that your system had a proper shutdown. For more details on Event IDs, check Identify System Events section listed above.

Final Words

This brings us to the end of this guide, where we discussed all the nifty methods to check the system’s startup and shutdown details on Windows. If you found it useful, spread the word with your friends and subscribe to GadgetsToUse for more interesting explainers. Meanwhile, don’t forget to check other help links related to Windows 11 and 10.

You might be looking for:

2 Ways to Add an Extra Taskbar to Windows 11/10
8 Ways to Force Quit Apps on Windows
7 Ways to Resize Icons on Windows 11 and 10
11 Ways to Disable All Advertisements on Windows PC

You can also follow us for instant tech news at Google News or for tips and tricks, smartphones & gadgets reviews, join GadgetsToUse Telegram Group, or for the latest review videos subscribe GadgetsToUse Youtube Channel.

Was this article helpful?

YesNo

Источник