If you want to find out when was the last time your Windows rebooted and started up, for what reason, this post shows how to find out it in an easy way using Event Logs and PowerShell.
Using Event Logs
1 - Open the Event Viewer, and then click on System:
2 - Filter the events by clicking on Filter Current Log..., as shown below:
3 - Next, add the Event IDs 6006 and 6005, and click on Ok:
4 - Now you will be able to see the last time the system reboot and startup:
Event ID 6006: “The event log service was stopped.” This is synonymous to system shutdown.
Event ID 6005: “The event log service was started.” This is synonymous to system startup.
Using PowerShell
1 - Open the PowerShell prompt and type the cmdlet:
get-eventlog System | where-object {$_.EventID -eq "6005"} | sort -desc TimeGeneratedNote: Change the event ID to 6006 to find the reboot time.
Why the Windows rebooted and by which user?
You may want to find out another useful information related to system boot time, and many times to know why the server (mainly) was rebooted and for which user.
So let's have a look below on the main Event Logs you need to be aware.
Event ID 6008: "The previous system shutdown was unexpected." Records that the system started after it was not shut down properly.
Event ID 6009: Indicates the Windows product name, version, build number, service pack number, and operating system type detected at boot time.
Event ID 6013: Displays the uptime of the computer.
Event ID 1074: "The process X has initiated the restart / shutdown of computer on behalf of user Y for the following reason: Z." Indicates that an application or a user initiated a restart or shutdown.
Event ID 1076: "The reason supplied by user X for the last unexpected shutdown of this computer is: Y." Records when the first user with shutdown privileges logs on to the computer after an unexpected restart or shutdown and supplies a reason for the occurrence.
For any doubts or suggestions, please leave a comment below.