Steps to view startup and shutdown history in Windows 10

Sometimes in the process of using a computer, you will need information such as system startup and shutdown history. For example, if you are a system administrator, the shutdown history data can play a useful role in troubleshooting procedures. Or sometimes you also want to know the history of turning on and off the system to see if your computer has been accessed illegally.

In this article, we will learn two ways to track Windows 10 PC startup and shutdown times correctly.

Use Event Viewer to extract startup and shutdown times

Windows Event Viewer is a great tool to help save all the activities that are happening on the computer. For each event that occurs on the system, the Event Viewer records an entry. Event Viewer is handled by the eventlog service, which cannot be stopped or turned off manually, as it is a core Windows service. In addition, Event Viewer will also log the startup and shutdown history of the eventlog service. Therefore, you can leverage this data to know when your computer is on or off.

Eventlog service events are logged with 2 event codes (Event IDs). ID 6005 indicates that the eventlog service has been started, while ID 6009 indicates that the eventlog service has been stopped. Take a look at the entire process of extracting this information from the Event Viewer.

Step 1. Open Event Viewer (by pressing Win + R and entering keywords eventvwr).

Step 2. Look in the left pane, open ' Windows Logs -> System '.

Step 3. In the middle pane, you'll see a list of events that happened while Windows was running. First, sort the event log with the corresponding ID by clicking the Event ID label. The data related to the Event ID column will be reordered.

Step 4. If your event log is too large, sorting will not be available. You can now create a filter

task pane on the right side. Just click ' Filter current log '.

Step 5. Enter 6005 , 6006 in the Event ID field labeled < All Event IDs >. You can also specify the time period in the Logged section .

1. Event ID 6005 will be labeled as 'The event log service was started'. This means that a system boot session has been performed.
2. Event ID 6006 will be labeled as 'The event log service was stopped', corresponding to a system shutdown.

If you want to dig deeper, you can check out Event ID 6013, which shows the computer's uptime, and Event ID 6009 which shows processor information detected during boot time. Event ID 6008 will tell you that the system has started up after not being shut down properly.

Using the TurnedOnTimesView widget

TurnedOnTimesView is a simple tool that you can use to check startup and shutdown history. This utility can be used to view the list of shutdown and startup times of local computers or any remote computer connected to the network.

To use it, you will just need to extract and execute the TurnedOnTimesView.exe file. The application will immediately list you the startup time, the shutdown time, the active time between each shutdown and the shutdown, as well as the reason for the shutdown.

To see the startup and shutdown times of a remote computer, navigate to 'Options -> Advanced Options' and select 'Data source as Remote Computer'. Specify the computer's IP address or name in the Computer Name field, then click OK. Immediately, there will be a list showing detailed information of the corresponding computer, including data on the time on and off as mentioned above.

While you can always use Event Viewer for detailed breakdown of startup and shutdown times, TurnedOnTimesView has the advantage of a very simple and exceptionally easy-to-use interface. Which method to use depends on your preference.

David Pac

Update 06 July 2021