How to Check When a Computer Was Turned On and Shut Down in Windows

Quick Answer: Which Windows Logs Show Power Events?

Windows records most startup, shutdown, restart, sleep, wake, and power-loss events in Event Viewer. The most useful log is usually Windows Logs → System. For a simple history, look for these Event IDs:

How to Check Computer Startup and Shutdown Times in Event Viewer

Event Viewer is the best built-in tool for checking when a Windows computer was turned on, restarted, or shut down. It works in both Windows 10 and Windows 11.

1. Press Win + R, type eventvwr.msc, and press Enter.
2. In the left panel, open Windows Logs.
3. Select System.
4. In the right panel, click Filter Current Log.
5. In the Event IDs field, enter: 6005, 6006, 6008, 1074, 41.
6. Click OK.
7. Check the Date and Time column for each event.

Double-click an event to see more details. For example, Event ID 1074 may show which process or user initiated a shutdown or restart. Event ID 6008 indicates that Windows detected an unexpected shutdown.

Best Event IDs to Find When Windows Was Turned On or Shut Down

Filtering the System log by Event ID makes the results much easier to read. The table below explains the most useful events for checking Windows power history.

For normal daily activity, Event IDs 6005 and 6006 are usually enough. For crashes or sudden power loss, check 6008 and 41. For planned restarts, check 1074.

How to View Windows Startup and Shutdown History with PowerShell

PowerShell is useful when you want a quick list of startup and shutdown events without manually browsing Event Viewer.

Show recent startup, shutdown, restart, and crash events

Right-click Start, select Terminal or Windows PowerShell, and run:

PowerShellGet-WinEvent -FilterHashtable @{
    LogName = 'System'
    Id = 6005,6006,6008,1074,41
} -MaxEvents 50 | Select-Object TimeCreated, Id, ProviderName, Message | Format-List

This command displays the most recent matching events from the System log. The TimeCreated field shows when the event was recorded.

Show only startup events

PowerShellGet-WinEvent -FilterHashtable @{LogName='System'; Id=6005} -MaxEvents 20 |
Select-Object TimeCreated, Id, ProviderName

Show only normal shutdown events

PowerShellGet-WinEvent -FilterHashtable @{LogName='System'; Id=6006} -MaxEvents 20 |
Select-Object TimeCreated, Id, ProviderName

Show unexpected shutdowns and power failures

PowerShellGet-WinEvent -FilterHashtable @{LogName='System'; Id=6008,41} -MaxEvents 30 |
Select-Object TimeCreated, Id, ProviderName, Message | Format-List

How to Check the Last Windows Boot Time Using Command Prompt

If you only need the most recent boot time, use Command Prompt or PowerShell with systeminfo. This does not show the full shutdown history, but it is fast.

1. Press Win + R, type cmd, and press Enter.
2. Run this command:

Command Promptsysteminfo | find "System Boot Time"

On some non-English Windows installations, the text may be localized. In that case, run:

Command Promptsysteminfo

Then look for the line that shows the system boot time. In PowerShell, you can also use:

PowerShell(Get-CimInstance Win32_OperatingSystem).LastBootUpTime

How to Check Unexpected Shutdowns in Windows Reliability Monitor

Reliability Monitor provides a visual timeline of crashes, failed updates, application errors, and unexpected shutdowns. It is easier to read than Event Viewer, although it gives fewer technical details.

1. Press Win + R.
2. Type perfmon /rel and press Enter.
3. Look for days marked with a red error icon.
4. Click a day and check for entries such as Windows was not properly shut down.

Reliability Monitor is especially useful when you want to know whether the computer crashed, restarted unexpectedly, or lost power on a specific day.

How to Check When a Windows Computer Woke from Sleep

If the computer was not fully shut down but only entered sleep or hibernation, startup and shutdown Event IDs may not show the complete story. To check wake events, use Event Viewer:

1. Open Event Viewer.
2. Go to Windows Logs → System.
3. Click Filter Current Log.
4. In Event sources, select Power-Troubleshooter.
5. Look for Event ID 1.

You can also use PowerShell:

PowerShellGet-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Power-Troubleshooter'} -MaxEvents 20 |
Select-Object TimeCreated, Id, Message | Format-List

To see what last woke the computer, run this command in Command Prompt or Terminal:

Command Promptpowercfg /lastwake

To list devices that are allowed to wake the computer, run:

Command Promptpowercfg /devicequery wake_armed

How to Export Windows Startup and Shutdown History

If you need to send the log to a technician or save it for later, export the filtered results from Event Viewer or PowerShell.

Export from Event Viewer

1. Open Event Viewer.
2. Filter the System log by Event IDs 6005, 6006, 6008, 1074, 41.
3. Click Save Filtered Log File As in the right panel.
4. Save the file as .evtx.

Export to CSV with PowerShell

PowerShellGet-WinEvent -FilterHashtable @{
    LogName = 'System'
    Id = 6005,6006,6008,1074,41
} -MaxEvents 200 |
Select-Object TimeCreated, Id, ProviderName, Message |
Export-Csv "$env:USERPROFILE\Desktop\windows-power-history.csv" -NoTypeInformation -Encoding UTF8

The exported CSV file will appear on the desktop and can be opened in Excel, LibreOffice Calc, or any text editor.

Why Startup or Shutdown Events May Be Missing in Windows

Sometimes the log does not show the exact event you expect. Common reasons include:

• Fast Startup is enabled: Windows may use a hybrid shutdown process instead of a full shutdown.
• The computer slept or hibernated: sleep and wake events are different from full startup and shutdown events.
• The System log was cleared: old events disappear if someone cleared the log manually.
• The log size is too small: Windows may overwrite older events when the log reaches its maximum size.
• Power was lost suddenly: Windows may record Event ID 41 or 6008, but it cannot record a normal shutdown event if power was cut immediately.
• The clock was wrong: incorrect BIOS/UEFI time, time zone settings, or synchronization problems can make event times misleading.

FAQ: Checking Windows Computer On and Off Times

Can I see the exact time when the PC was turned on?

You can usually see the approximate Windows startup time using Event ID 6005 or the LastBootUpTime value. This shows when Windows started, not necessarily the exact second the physical power button was pressed.

Can I see who shut down or restarted the computer?

Sometimes. Event ID 1074 may show the user account and process that initiated a planned shutdown or restart. It will not help if the PC lost power or was forced off with the power button.

How can I check if the computer was shut down unexpectedly?

Look for Event ID 6008 and Kernel-Power Event ID 41 in the System log. You can also open Reliability Monitor with perfmon /rel and look for Windows was not properly shut down.

Does Windows keep startup and shutdown history forever?

No. Event logs have a maximum size. When the log becomes full, older events may be overwritten depending on the log settings.

Is there a difference between shutdown, sleep, and hibernation in the logs?

Yes. A full shutdown usually creates shutdown and startup-related events. Sleep and wake activity is usually shown through Power-Troubleshooter and power management events.