The easiest way to determine the last shutdown date/time is to check the event logs. When you shutdown a computer Event ID 6006 is written to the Event log which denotes a clean shutdown. Here is a sample event.

Ref: Windows Event IDs 6005, 6006, 6008, and 6009.

1. Launch Eventvwr.msc to start the Event Viewer.

2. Click System

Note: In Windows Vista, you need to double-click Windows Logs, and select System.

3. Sort the results by Date (descending)

4. Locate the most recent entry with the ID of 6006 and the Source column reading eventlog

5. Note down the date and time of that entry. This is the last shutdown time.

Note: Windows Vista also writes event 1074 (STATUS_SHUTDOWN_CLEAN) when shut down.

Using the registry

Windows also stores the last shutdown date and time in a REG_BINARY value named ShutdownTime in the following branch:

To convert the Binary data to readable form, you may use the script from VisualBasicScript.com.

strValueName = "HKLM\SYSTEM\CurrentControlSet\Control\Windows\" _
& "ShutdownTime"
Set oShell = CreateObject("WScript.Shell")
Ar = oShell.RegRead(strValueName)
Term = Ar(7)*(2^56) + Ar(6)*(2^48) + Ar(5)*(2^40) + Ar(4)*(2^32) _
+ Ar(3)*(2^24) + Ar(2)*(2^16) + Ar(1)*(2^8) + Ar(0)
Days = Term/(1E7*86400)
WScript.Echo "ShutdownTime = " & CDate(DateSerial(1601, 1, 1) + Days) _
& " UTC"

Copy the above code to Notepad and save the file with ".vbs" extension. Double-click the script to run it.

Another way is to use the Registry Editor to export the above registry key to a file in .txt format (rather than .reg). This format shows the last write time of the key. When Windows updates the ShutdownTime value, the last write time of the key is updated. This is not a reliable way, as the last write time of a key changes when any other value under that key is changed.

See also

How to determine the system uptime in Windows Vista

Related Posts

• Microsoft Time Zone: Keep Track of the Time in Other Parts of the World
• Add Enhanced Shutdown Button to the Windows XP Start Menu
• Script to Retrieve Last Logon Date and Time for Local User Accounts in Windows
• Deleted Files Are Shown When Performing a Search in Windows Vista
• Change Vista Start Menu Power Button Action to Shut Down the Computer

If you enjoyed this post, make sure you subscribe to our RSS feed! We feature Tips, Troubleshooting information, Scripts and Utilities for Microsoft Windows Operating Systems!

Prefer an E-mail subscription?

Enter your email address:

Delivered by FeedBurner