The Winhelponline Blog

The easiest way to determine the last shutdown date/time is to check the event logs. When you shutdown a computer Event ID 6006 is written to the Event log which denotes a clean shutdown. Here is a sample event.

Ref: Windows Event IDs 6005, 6006, 6008, and 6009.

1. Launch Eventvwr.msc to start the Event Viewer.

2. Click System

Note: In Windows Vista, you need to double-click Windows Logs, and select System.

3. Sort the results by Date (descending)

4. Locate the most recent entry with the ID of 6006 and the Source column reading eventlog

5. Note down the date and time of that entry. This is the last shutdown time.

Note: Windows Vista also writes event 1074 (STATUS_SHUTDOWN_CLEAN) when shut down.

Using the registry

Windows also stores the last shutdown date and time in a REG_BINARY value named ShutdownTime in the following branch:

To convert the Binary data to readable form, you may use the script from VisualBasicScript.com.

strValueName = "HKLM\SYSTEM\CurrentControlSet\Control\Windows\" _
& "ShutdownTime"
Set oShell = CreateObject("WScript.Shell")
Ar = oShell.RegRead(strValueName)
Term = Ar(7)*(2^56) + Ar(6)*(2^48) + Ar(5)*(2^40) + Ar(4)*(2^32) _
+ Ar(3)*(2^24) + Ar(2)*(2^16) + Ar(1)*(2^8) + Ar(0)
Days = Term/(1E7*86400)
WScript.Echo "ShutdownTime = " & CDate(DateSerial(1601, 1, 1) + Days) _
& " UTC"

Copy the above code to Notepad and save the file with ".vbs" extension. Double-click the script to run it.

Another way is to use the Registry Editor to export the above registry key to a file in .txt format (rather than .reg). This format shows the last write time of the key. When Windows updates the ShutdownTime value, the last write time of the key is updated. This is not a reliable way, as the last write time of a key changes when any other value under that key is changed.

See also

How to determine the system uptime in Windows Vista

Bookmark this Page!

BlinkList | del.icio.us | Digg it | Furl | reddit | Spurl | StumbleUpon |

Related Posts

• Microsoft Time Zone: Keep Track of the Time in Other Parts of the World
• Add Enhanced Shutdown Button to the Windows XP Start Menu
• Deleted Files Are Shown When Performing a Search in Windows Vista
• List Running Processes and Their Creation Times
• Change Vista Start Menu Power Button Action to Shut Down the Computer
• How to Search for Files Created Between Two Dates in Windows Vista
• How to Schedule a System State Backup in Windows XP Using NTBackup
• How to Clear System Information Tool (MSInfo32.Exe) History in Windows XP
• Determine the Target Path of Windows Installer Shortcuts
• Windows 7 Is Now Available for MSDN and TechNet Subscribers

If you enjoyed this post, make sure you subscribe to our RSS feed! We feature Tips, Troubleshooting information, Scripts and Utilities for Microsoft Windows Operating Systems!

Prefer an E-mail subscription?

Enter your email address:

Delivered by FeedBurner