Are you wondering what happens when your computer shuts down and after it restarts? Many things happen within that period, and thankfully, Windows helps track the entire process and keeps a record in the system log.
With the built-in Windows Event Viewer, you can monitor the activities that occur on your computer before, during, and after it shuts down or restarts.
In this article, we’ll teach you how to do that, but first, what is the Event Viewer?
What Is the Windows Event Viewer?
The Event Viewer records application and system messages on a Windows 10 PC and logs every action taken while working on the computer.
That said, if many users operate a computer, you can use the Event Viewer to monitor each user’s activities while the device is running.
Also, it helps users discover errors, information messages, and warnings on their PCs. What’s more, you can’t alter, stop, or disable the activities of the Event Viewer altogether because it’s a core Windows service.
In many cases, you can start troubleshooting any issue on a Windows computer from the Event Viewer. However, as a rule of thumb, you don’t need to panic even if there are alarming messages or warnings in the system log.
Unfortunately, some fraudsters take advantage of messages in the Event Viewer to scare and defraud people. They can manipulate it to display error messages and warnings even if your computer is working correctly.
Without much ado, let’s show you how to track what happens when your computer shuts down or starts using the Windows Event Viewer or the Command Prompt.
Most Common Events Related to Startup and Shutdown Times
There are many identified events related to shutting down and restarting a Windows 10 PC. However, we will show you the most common four in this article, and they include the following:
- Event ID 41: It shows that your Windows computer rebooted without shutting down completely.
- Event ID 1074: Your computer records this event when an application forces your laptop to shut down or restart. This event also helps you know when a user restarted or shut down the computer from the Start menu or by using
Ctrl + Alt +Del. - Event ID 6006: You will have this event recorded if your Windows computer shuts down correctly.
- Event ID 6008: At times when your computer shuts down abnormally or unexpectedly, you will see this event in your system log.
How to See PC Startup and Shutdown History in Windows 10?
Using the Windows Event Viewer, you can quickly determine the events on your computer after shutting down or restarting. You can also access some of the events using the Command Prompt, as we will show you below.
Generally, there are two methods to check the events related to shutdown or restart on your computer.
Method 1: View the shutdown and restart Log from the Event Viewer
Follow the steps below to view shutdown and restart activities using Event Viewer:
- Press the
Windows logo + Rkeys to invoke the Run dialog - Type
eventvwr.mscand hit Enter. - The Event Viewer windows will open. After that, navigate to Windows Logs > System on the left pane.
- Click on Filter Current Log on the right.
- Type 41,1074,6006,6008 into the textbox under Includes/Excludes Event IDs, and then click OK to filter the event log
After completing all the steps, Windows Event Viewer will display only activities related to the shutdown.
From Windows 10 Fall Creators Update, the OS can automatically reopen apps that were running before your computer shut down or restarted.
This information is handy for Windows users who upgraded their OS to the recent release.
You can avoid this issue by doing the following:
- Adding a unique Shut Down context menu to the Desktop to restore the classic behavior
- Seeing the last shutdown time, using Command Prompt”
Also Read: [QUICK SOLUTION] How to Find Out the Cause of BSODs Using the Event Viewer
Method 2: View the shutdown and restart log using the Command Prompt
If the first method is not convenient for you, you can use Windows Command Prompt to check the system log by following the steps below:
- Press the
Windows logo + Rkeys to open the run dialog, and then typecmdto open Command Prompt. - Copy and paste the code below in the Command Prompt window, and press Enter:
wevtutil qe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1
- If what you want instead is to view only the timestamp of the last shutdown, copy and paste the code below and then press Enter:
wevtutil qe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1 | findstr /i "date"
That’s all!
You can use the Command Prompt to view the shutdown and startup log on Windows 10. However, we recommend using the Event Viewer, mainly because it’s simple and straightforward.
Moreover, you don’t have to copy-paste codes, which fraudsters can take advantage of to hack into your computer.
Are You Unable to View the Restart and Shutdown Log on Your Windows 10 PC?
If you have computer issues like corrupt keys or junk files, it may be challenging to view restart and shutdown events on your PC.
We always advise people to use our registry cleaner to get rid of problematic files that can harm their computers. Auslogics BoostSpeed helps to remove all harmful files in the registry.
Also, BoostSpeed helps to enhance your computer’s speed and performance by tweaking non-optimal system settings.
The software modifies Internet connection settings to ensure seamless browsing, quicker downloads, and better audio/video call quality.
How to See the Shutdown Log in Windows 11
If you are using Windows 11, viewing the startup and shutdown log is also a walk in the park. This guide will explain exactly how to go about it:
- Go to the search bar and type in command.
- Right-click on the Command Prompt result that appears.
- Select Yes in the User Account Control confirmation prompt box.
- When the Command Prompt opens, type in the following command and then press Enter:
wevtutilqe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1
- This should help you access the data you want. However, if you only want to view the date and time of these events, then execute the command below:
wevtutilqe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1 | findstr /i "date"
Conclusion
If you cannot view startup and shutdown events on your computer using the methods we have shared, please provide us with more details.
We’d also love it if you left a comment and shared our post on your social media. For more tips about Windows 10-related issues, visit our blog.
FAQ
To open Event Viewer, follow the instructions again and go to the “System” log under “Windows Logs.” Search for events with the “Event ID 1076” prefix, denoting system reboots. These events provide insight into the history of system reboots on your Windows 11 machine by revealing the reason for the reboot and the person who started it. Reboot history analysis allows you to spot trends and problems compromising system stability. To view events regarding the system, expand the “Windows Logs” section in the Event Viewer window and choose “System.” This section contains various system events, including faults, warnings, and changes to the hardware and software. Double-clicking any event will allow you to examine more details and perform system troubleshooting. The process for reading shutdown logs is the same, except instead of looking for events with “Event ID 6005” for system starting and “Event ID 6006” for system shutdown, execute the following actions. By tracking these events, you may monitor the history of system boots and shutdowns over time, as they offer timestamps and more information about each startup and shutdown instance. Expand the “Windows Logs” section on the left panel of the Event Viewer window, then click “System.” Now, a list of occurrences appears on the right side. Search for events with the “Event ID 1074″—a shutdown indicator. Double-clicking any event will provide further information, including the shutdown’s cause.
