How to Monitor Computer Startup and Shutdown Events in Windows

Step-by-step guide to using Windows Event Viewer to track and analyze computer startup and shutdown events via key event IDs.

In this Guide:

Keeping an eye on when your computer starts up and shuts down can really help you understand its performance better and tackle any issues that pop up. In this article, we’ll walk you through how to track these events on Windows systems, with a special focus on Windows 11.

Understanding Startup and Shutdown Events

Every time your computer boots up or powers down, it records these events in the system logs. By monitoring these logs, you can spot patterns that might point to hardware problems, software conflicts, or other issues that could be affecting your system's performance.

Using Event Viewer in Windows 11

Event Viewer is a handy tool built into Windows that lets you dive into detailed logs of system events. Here’s how to access it and use it to keep tabs on start-ups and shut-downs:

  1. Open Event Viewer:  Hit Win + R, type in eventvwr.msc, and press Enter.
  2. Navigate to System Logs: In the Event Viewer window, expand Windows Logs and click on System in the left pane.
  3. Filter Logs:
    • Click on Filter Current Log in the right pane.
    • In the Event IDs field, enter the relevant event IDs:
      • 6005: System started 
      • 6006: System stopped 
      • 6008: Unexpected shutdown
  4. Review Logs: After applying the filter, take a look at the logs for specific entries related to startup and shutdown times.

Using Command Prompt for Quick Access

If you’re more of a command-line person, you can quickly check startup and shutdown times using Command Prompt:

  1. Open Command Prompt: ◦ Press Win + S, type cmd, right-click on it, and choose Run as administrator.
  2. Enter Commands: ◦ To see the last shutdown event:
    • wevtutil qe system "/q:*[System [(EventID=6006)]]" /rd:true /f:text /c:1 
    • To find out the date and time of shutdown events:
      • wevtutil qe system "/q:*[System [(EventID=6006)]]" /rd:true /f:text /c:1 | findstr /i "date"

Conclusion

Keeping track of your computer's start-up and shut-down events is essential for ensuring it runs smoothly. By using tools like Event Viewer and Command Prompt, you can easily monitor these events and troubleshoot any potential issues that arise.

Relevant Articles

  1. How to Check Active Directory (AD) Event Logs
  2. How to Export Event Viewer Logs: A Step-by-Step Guide
  3. How to Monitor Active Directory LDAP Logs

Frequently asked questions: