Quickly Find Your Computer’s Last Shutdown Date And Time In Windows

by on
18

Are you are curious to find out when was the last date and time the computer was shut down? If you are monitoring when the computers in the office environment or at home were last shutdown then you might want to know the exact date and time. Many office employees do not shutdown their computers and at home heavy downloader’s might not remember when there last shutdown occurred.

To find the exact date and time in Windows XP, click Start > Run and type Eventvwr.msc

run

Or in Windows Vista you can type Event Viewer in the Search Bar in Start menu.

start

If in Windows Vista User Access Control window pops up to ask for permission, click Continue.

In Windows XP: Click System.


In Windows Vista: You need to double click at the Windows Logs in the left sidebar and then System.

system of windows log

Now to find out the last time your computer was shutdown you need to sort the results by Date, so that its easier to distinguish between the last shutdown or any other shutdown before.

Locate the most recent entry with the ID of 6006 and the Source column reading eventlog. Event viewer tags ID to every process the system performance, 6006 is an ID for shutdown, since we have sorted the event viewer in descending order to its date and time, the first 6006 ID would now determine the last shutdown time.

shut down information

This date and time information displayed in the bottom windows indicated your last shutdown date and time. Now you can easily monitor the last time the computer was shutdown so that you can have an idea how much power was consumed when it was on idle.

Advertisement

  • Pingback: How do I find out what time I shut off my laptop last night? - Teen Forums

  • http://Google.com Tams

    Grate information,
    tank you

    • gfh

      ghgfh

  • Nirmal

    how to find system last shutdown time through commands
    pls send to the mail

  • Alex

    Thanks very much… This was very helpful

  • boim

    I can't find event ID 6.006 but 6.005 or 6.009,,thq

  • seiji7

    really helpful infos.
    thanks

  • NexaYa

    Just what I was looking for, thanks !!!

  • Karl

    This doesn’t work, it’s showing that I shut down the pc about 40 minutes ago…

  • Samir Gunic

    That’s wrong!
    =============
    The event ID 6006 with “EventLog” as source only indicates that the EventLog service has stopped. That’s it! It has nothing to do with shutting down the computer!

    However! It is true that the service will be stopped as a result of sutting down the computer and terminating all processes and services. Well of course it will be stopped then! What else would you expect?!

    But what you don’t realize is that just because the EventLog service stops does not necessarily mean that the computer is shutting down! In other words, you could stop the EventLog service without shutting down the computer! The first does not depend on the other!

    So, I hope you do realize now that the event ID 6006 with “EventLog” as source in System log does not say much about shutting down the computer. Right?

    To my knowledge, the only event ID with such a hight ID number as 6000 or above, that has to do with computer shutdown is the 6008 with the “EventLog” as srouce!

    What 6008 with “EventLog” as source means is that the computer has been indeed shutdown! But it’s by no way a normal shutdown! The level of this type of log entry is not “information”. It’s a “error” type of entry. The 6008 with “EventLog” as srouce means that the computer has been shutdown UNEXPECTEDLY!

    Where did you get the idea that event ID 6006 with “EventLog” as source always means that the computer has been shutdown?

    That’s not true. The only similar event ID with such a hight event ID numeber that DOES mean a computer shutdown is 6008, a UNEXPECTED shutdown to be specific! Not a normal shutdown!

    This is correct!
    ================
    Now! You want to find out when a COMPUTER USER has shutdown the computer, right? What you rally want to be looking for is event ID 1074 with USER32 as source!

    “As a general statement, this event records a system shutdown or restart in order for the administrators of that system to have a better understanding on how often and for what reasons the computer is shutdown or restarted. The event contains details about the process (the program) that performed this task, the computer that was affected and when applicable, the reason for the restart or shutdown. Also, the type of operation is recorded: restart when a user or an application initiates a system restart, shutdown when the system is sent a shutdown request or power off when the power button is pressed (and that initiates a shutdown).

    The process listed in the event provides an important clue as to who or what initiated the shutdown or the restart. Processes related the user’s environment such as Exlorer.exe or Winlogon indicate that the shutdown was initiated by a user while other type of processes such as svchost.exe.

    The comment shown in the event description is something that can be specified by the process that initiates the shutdown. For example, if an application is installed and the installer script requires a restart one may see a comment like “The Windows Installer initiated a system restart to complete or continue the configuration of “. Users of shutdown.exe command can also specify a text to be recorded as comment.”

  • Samir Gunic

    In short,

    1. Run Event Viewer (see instructions above)!

    2. Choose the System log!

    Windows XP: Click on “System” under “Event Viewer (Local)” folder on the Console tree on the left.

    Windows Vista: Click on “System” under “Windows Logs” and “Event Viewer (Local)” folder on the Console tree on the left.

    3. Open the filter dialog!

    Windows Vista: Click on “Filter current log…” from the Actions window on the right.

    Windows XP: From the View menu click on “Filter…”

    4. Specify to only filter events with ID 1074 and USER32 as source!

    In the filter dialog, type in “1074″ in the Event-ID field and “USER32″ in the “event sources” field (without quotes).

    XP Example: http://help.artaro.eu/images/winxp/xpevt08d.jpg

    Vista Example: http://i.t.com.com/i/tr/downloads/images/8-15-08-vr/8-15_Fig_E.png

    5. Click OK to close the dialog and start filtering! This may take a while, depending on how many events are logged and what filtering arguments you have used.

    6. Done! You should now see a complete list of all computer shutdowns or restarts, either initiated by the user or some process or device.

    You may also define more specifically what type of 1074 events you want to view. You could for example specify to view only 1074 events by a specific user on a specific computer.

    I hope this helps.

    • penny

      if this is true then someone ‘signed out’ TWICE on my laptop before i turned it on! How is this possible? I turned it off properly the night before!

    • boyz

      thanks samir! your info is correct.
      6006 can only see when i logon…
      while 1074 can see when i shutdown

  • ali

    great info, event 1074 helped find when my system was shut indeed!
    Thanks a lot
    a

  • milan

    GR8 information thanks

  • Shrikant Ranade

    in last windows i cannot see last shutdown id, eventlog time

  • Eugen

    sweet, thanks :)

  • Am Raut

    Thnks a lot……………………..

  • Chanthon

    how i can find wait time to kill on regedit