How to find out the last time Windows rebooted and started up
If you want to find out when was the last time Windows rebooted and started up, for what reason, this post shows how to find out it in an easy way using Event Logs and PowerShell.
Using Event Logs
1 – Open the Event Viewer, and then click on System:
2 – Filter the events by clicking on Filter Current Log…, as shown below:
3 – Next, add the Event IDs 6006 and 6005, and click on Ok:
4 – Now you will be able to see the last time the system reboot and startup:
Event ID 6006: “The event log service was stopped.” This is synonymous to system shutdown.
Event ID 6005: “The event log service was started.” This is synonymous to system startup.
Using PowerShell
1 – Open the PowerShell prompt and type the cmdlet:
get-eventlog System | where-object {$_.EventID -eq "6005"} | sort -desc TimeGenerated
Note: Change the event ID to 6006 to find the reboot time.
Why the Windows rebooted and by which user?
You may want to find out another useful information related to system boot time, and many times to know why the server (mainly) was rebooted and for which user.
So let’s have a look below on the main Event Logs you need to be aware.
Event ID 6008: “The previous system shutdown was unexpected.” Records that the system started after it was not shut down properly.
Event ID 6009: Indicates the Windows product name, version, build number, service pack number, and operating system type detected at boot time.
Event ID 6013: Displays the uptime of the computer.
Event ID 1074: “The process X has initiated the restart / shutdown of computer on behalf of user Y for the following reason: Z.” Indicates that an application or a user initiated a restart or shutdown.
Event ID 1076: “The reason supplied by user X for the last unexpected shutdown of this computer is: Y.” Records when the first user with shutdown privileges logs on to the computer after an unexpected restart or shutdown and supplies a reason for the occurrence.
Still need help finding out the last time Windows rebooted?
Running out of ideas or time finding out the last time Windows rebooted? Please contact me here, I will be happy to provide you with a quick analysis for resolution and configuration, at a fair price. Or use the form below if you prefer:
Check out more similar articles below
Microsoft 365 Setup: Practical Guide For IT Pros
Microsoft 365 Setup: Practical Step-by-Step Guide for IT Pros Welcome to Microsoft 365 Setup: Practical…
Ultimate Tutorial How to Deploy Hyper-V Failover Cluster
Ultimate Tutorial: How to deploy Hyper-V Failover Cluster This post aims to guidance you on…
How to configure NTP server in AD
How to configure NTP server in Active Directory, Step by step If you want to…
How to fix clients not showing up in WSUS
How to fix clients not showing up in WSUS If you are facing problems with…
The Ultimate Guide: What is DSRM in Active Directory
The Ultimate Guide: What is DSRM in Active Directory (Directory Services Restore Mode)? Directory Services…
How to add UPN suffix in Active Directory
How to add UPN suffix in Active Directory If you want to know how to…