How to Identify the Last Reboot/Startup of the Windows

Event ID
How to Identify a System Reboot

If you want to know the last time the Windows rebooted/startup, perform the following steps:

1 - Open the Envent Viewer, and then click on System.


2 - Filter the events by clicking on the option as shown below:


3 - Next, include the ID's 6006, 6005, as shown below:



After to click on the Ok button, you will be able to see the last time the system reboot and startup.

More information about the Events IDs below:


Event ID 6005: “The event log service was started.” This is synonymous to system startup.
Event ID 6006: “The event log service was stopped.” This is synonymous to system shutdown.

Event ID 6008: "The previous system shutdown was unexpected." Records that the system started after it was not shut down properly.
Event ID 6009: "Indicates the Windows product name, version, build number, service pack number, and operating system type detected at boot time.
Event ID 6013: "Displays the uptime of the computer. There is no TechNet page for this id.
Event ID 1074: "The process X has initiated the restart / shutdown of computer on behalf of user Y for the following reason: Z." Indicates that an application or a user initiated a restart or shutdown.
Event ID 1076: "The reason supplied by user X for the last unexpected shutdown of this computer is: Y." Records when the first user with shutdown privileges logs on to the computer after an unexpected restart or shutdown and supplies a reason for the occurrence.

Comentários