ByIt can be essential for Windows 11 users to know when their system started and shut down. Sometimes it becomes essential to track Startup and Shutdown History for troubleshooting, performance analysis, or security auditing. In this article, we will explain in detail how you can check Startup and Shutdown Logs in Windows 11.
Ways to View Startup and Shutdown Logs in Windows 11
Windows 11 provides you with important tools that allow you to obtain complete information about the startup and shutdown times of your system. You can easily get this data using the methods given below.
1. View Startup and Shutdown History through Event Viewer
Event Viewer is an in-built tool that keeps a record of every action happening in your system. It also contains logs related to Startup and Shutdown.
To open Event Viewer:
1. Open the Search Bar by pressing Windows + S.
2. Type “Event Viewer” and press Enter.
3. In the left panel, click Windows Logs > System.
Filter Startup and Shutdown Logs:
1. Click Filter Current Log on the right side.
2. Enter the Event ID:
6005 – System Startup (Event Log Started)
6006 – System Shutdown (Event Log Stopped)
6008 – Unexpected Shutdown (Crash)
6013 – System Uptime
3. Click OK. Now you will see all the logs related to Startup and Shutdown.
2. Get Startup and Shutdown Information via PowerShell
If you are a command-line user, Windows PowerShell is a great tool.
PowerShell command:
“`powershell
Get-EventLog -LogName System -InstanceId 6005,6006,6008 | Format-Table TimeGenerated, EntryType, EventID, Message -AutoSize
“`
This command will show information related to Startup (6005), Shutdown (6006), and Unexpected Shutdown (6008).
3. Get Startup/Shutdown details from Command Prompt
It is also possible to search for events through the Command Prompt:
To see Shutdown events:
“`cmd
wevtutil qe System “/q:*[System[(EventID=6006)]]” /f:text /c:5
“`
This command will give you information about the last 5 Shutdown events.
To view Startup events:
“`cmd
wevtutil qe System “/q:*[System[(EventID=6005)]]” /f:text /c:5
“`
4. Create Custom Logs via Task Scheduler
If you want to run specific tasks, such as email alerts or scripts on every Startup or Shutdown, you can use Task Scheduler.
To set up a Task in Task Scheduler:
1. Search and open “Task Scheduler” in the search bar.
2. Click Create Basic Task.
3. Name the task, such as “Log Startup“.
4. Select When the computer starts.
5. In the next screen, you can trigger a script or command.
Full list of Event IDs that represent Startup/Shutdown
| Event ID | Description |
| ——————— | ————————————– |
| 6005 | Event Log Service Started (Startup) |
| 6006 | Event Log Service Stopped (Shutdown) |
| 6008 | Unexpected Shutdown |
| 6013 | System Uptime |
| 1074 | Planned Shutdown |
| 1076 | Reason for unexpected shutdown |
| 41 (Kernel-Power) | System rebooted without clean shutdown |
Through these Event IDs, you can easily find out when and how the computer was shut down or turned on.
Analysis of Unexpected Shutdown and Crash Logs
If your system is shutting down suddenly again and again, then pay special attention to Event ID 6008 and 41 (Kernel-Power).
6008: This indicates that the system has been shut down without any proper shutdown process. The reason for this could be a power outage, crash, or hardware failure.
41 (Kernel-Power): This occurs when the system shuts down directly due to power loss.
Checking System Uptime (How long the system has been on)
You can also find out the System Uptime in Windows 11, i.e., how long your computer has been on.
From Command Prompt:
“`cmd
systeminfo | find “System Boot Time”
“`
or
“`cmd
net statistics workstation
“`
This will let you know how long the system has been on.
Conclusion
Checking Startup and Shutdown History in Windows 11 is not a difficult task; you just need to know the right tools and commands. Whether you use Event Viewer, PowerShell, or Command Prompt, you can easily access your system logs, and this information can prove to be extremely useful for troubleshooting, performance analysis, and system monitoring.
Want to grow your website organically? Contact us now
Frequently Asked Questions (FAQ) – How to check Startup and Shutdown History in Windows 11
Q1: How can I find out when the system was turned on and off in Windows 11?
Answer: You can get this information using Event Viewer in Windows 11. By going to System Logs, you can see Event ID 6005 (Startup), 6006 (Shutdown), and 6008 (Unexpected Shutdown).
Q2: Can I also view Startup and Shutdown History from the Command Prompt?
Answer: Yes, you can view Event Logs related to Startup and Shutdown by using the `wevtutil` command in Command Prompt.
Example:
“`cmd
wevtutil qe System “/q:*[System[(EventID=6006)]]” /f:text /c:5
“`
Q3: Which Event IDs are related to Startup and Shutdown?
Answer:
| Event ID | Description |
| ———— | ——————————————- |
| 6005 | System started up |
| 6006 | System shut down |
| 6008 | Unexpected Shutdown |
| 6013 | Shows system uptime |
| 41 | Kernel-Power Crash (reboot without shutdown) |
Q4: Is there any log for the Unexpected Shutdown?
Answer: Yes, Event ID 6008 represents Unexpected Shutdown. If your system has a sudden shutdown (such as a power outage), this log records it.
Question 5: Can I create a custom alert on every Startup or Shutdown?
Answer: You can set up a custom script or alert on every Startup or Shutdown through Task Scheduler. This feature is useful for system monitoring.
Question 6: Can System Uptime information also be seen in Windows 11?
Answer: Yes, you can know how long the system has been on by using the `systeminfo` or `net statistics workstation` command in Command Prompt.
Question 7: Can this information also be found in PowerShell?
Answer: Yes, the PowerShell command given below gives information for both Startup and Shutdown:
“`powershell
Get-EventLog -LogName System -InstanceId 6005,6006,6008 | Format-Table TimeGenerated, EntryType, EventID, Message -AutoSize
