records application and system messages on a Windows 10 PC and logs every action taken while working on the computer. That said, if many users operate a computer, you can use the Event Viewer to monitor each user\u2019s activities while the device is running. Also, it helps users discover errors, such as blue screens of death (BSODs) <\/a>, information messages, and warnings on their PCs. What\u2019s more, you can\u2019t alter, stop, or disable the activities of the Event Viewer altogether because it\u2019s a core Windows service. In many cases, you can start troubleshooting any issue on a Windows computer from the Event Viewer. However, as a rule of thumb, you don\u2019t need to panic even if there are alarming messages or warnings in the system log. Unfortunately, some fraudsters take advantage of messages in the Event Viewer to scare and defraud people. They can manipulate it to display error messages and warnings even if your computer is working correctly. Without much ado, let\u2019s show you how to track what happens when your computer shuts down or starts using the Windows Event Viewer or the Command Prompt.<\/p>\n There are many identified events related to shutting down and restarting a PC. However, we will show you the most common four in this article, and they include the following:<\/p>\n Using the Windows Event Viewer, you can quickly determine the shutdown or reboot event IDs on your computer after shutting down or restarting. You can also access some of the events using the Command Prompt, as we will show you below.<\/p>\n Generally, there are two methods to check the reboot or shutdown event ID s on your computer. The steps for both methods to view the Windows shutdown log (or the restart one) on Windows 10 and 11 are absolutely the same.<\/p>\n Follow the steps below to view shutdown and restart activities using Event Viewer:<\/p>\n After completing all the steps, the Event Viewer will only display the Windows shutdown log .<\/p>\n<\/div>\n You can avoid this Windows update issue <\/a> by doing the following:<\/p>\n Also read:<\/b>A Problem Has Been Detected and Windows Has Been Shut Down <\/a><\/p>\n If the first method is not convenient for you, you can use the Command Prompt to check the Windows restart log (or the shutdown one if that\u2019s your case) by following the steps below:<\/p>\n That\u2019s all! You can use the Command Prompt to view the Windows shutdown and startup log on Windows 10 and 11. However, I recommend using the Event Viewer, mainly because it\u2019s simple and straightforward. Moreover, you don\u2019t have to copy-paste codes, which fraudsters can take advantage of to hack into your computer.<\/p>\n If you have computer issues like junk or corrupted files <\/a> or registry keys, it may be challenging to get to see the Windows restart log (or the shutdown one) and view restart and shutdown events on your PC. <\/div>\r\n<\/div>\r\n\n If you still can\u2019t get to see the Windows shutdown log to view startup and shutdown events on your computer using the methods we have shared, please provide us with more details.<\/p>\n We\u2019d also love it if you left a comment and shared our post on your social media. For more tips about Windows-related issues, visit our blog.<\/p>\n That\u2019s pretty straightforward. Follow these steps:<\/p>\n If your computer is stuck in a restart loop <\/a>, try booting into Safe Mode:<\/p>\n If you\u2019re still stuck, you might need to use a bootable USB <\/a> to repair your Windows installation.<\/p>\n \r\n\t<\/div>\r\n<\/div>\nMost Common Windows Reboot and Shutdown Event IDs<\/h2>\n
\n
How to See PC Startup and Shutdown Logs in Windows 10\/11?<\/h2>\n
Method 1: View the shutdown and restart log from the Event Viewer<\/h3>\n
\n
Windows logo + R<\/code> keys to invoke the Run<\/em> dialog.<\/li>\neventvwr.msc <\/code>\u00a0 <\/i>and hit Enter<\/code>.<\/li>\n<\/ul>\n![\"Press](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2024\/08\/View-the-shutdown-1.png\")
\r\n <\/div>\r\n \n
![\"The](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2024\/08\/View-the-shutdown-2.png\")
\r\n <\/div>\r\n \n
41,1074,6006,6008 <\/code> into the textbox under Includes\/Excludes Event IDs <\/i>, and then click OK <\/i> to filter the event log to the desired shutdown\/ reboot event ID s.<\/li>\n<\/ul>\n![\"Type](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2024\/08\/View-the-shutdown.png\")
\r\n <\/div>\r\n \n
\n
\nMethod 2: View the shutdown and restart log using the Command Prompt<\/h3>\n
\n
Windows logo + R<\/code> keys to open the run<\/em> dialog, and then type cmd <\/code>. <\/i>That\u2019s how you open the Command Prompt<\/em>.<\/li>\n<\/ul>\n![\"Press](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2024\/08\/View-the-shutdown-1-1.png\")
\r\n <\/div>\r\n \n
Enter<\/code>:<\/li>\n<\/ul>\nwevtutil qe system \"\/q:*[System [(EventID=1074)]]\" \/rd:true \/f:text \/c:1<\/pre>\n
![\"Copy](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2024\/08\/View-the-shutdown-3.png\")
\r\n <\/div>\r\n \n
wevtutil qe system \"\/q:*[System [(EventID=1074)]]\" \/rd:true \/f:text \/c:1 | findstr \/i \"date\"<\/pre>\n
![\"Copy](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2024\/08\/View-the-shutdown-3-1.png\")
\r\n <\/div>\r\n Windows Restart\/Shutdown Logs: Explained<\/h2>\n
FAQ<\/h2>\n
\n
shutdown \/s \/f \/t 0 <\/code>\u00a0in the location box.<\/li>\nshutdown \/r \/f \/t 0 <\/code>. <\/i><\/li>\n\n
F8<\/code> key (or Shift + F8<\/code>) before the Windows logo appears to enter the Advanced Boot Options<\/em>.<\/li>\nEnter<\/code>.<\/li>\n