The easiest way to determine the last shutdown date/time is to check the event logs. When you shutdown a computer Event ID 6006 is written to the Event log which denotes a clean shutdown. Here is a sample event.
Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6006
Time: 3:35:20 PM
The Event log service was stopped.
1. Launch Eventvwr.msc to start the Event Viewer.
2. Click System
Note: In Windows Vista, you need to double-click Windows Logs, and select System.
3. Sort the results by Date (descending)
4. Locate the most recent entry with the ID of 6006 and the Source column reading eventlog
5. Note down the date and time of that entry. This is the last shutdown time.
Note: Windows Vista also writes event 1074 (STATUS_SHUTDOWN_CLEAN) when shut down.
Using the registry
Windows also stores the last shutdown date and time in a REG_BINARY value named ShutdownTime in the following branch:
To convert the Binary data to readable form, you may use the script from VisualBasicScript.com.
strValueName = "HKLM\SYSTEM\CurrentControlSet\Control\Windows\" _
Set oShell = CreateObject("WScript.Shell")
Ar = oShell.RegRead(strValueName)
Term = Ar(7)*(2^56) + Ar(6)*(2^48) + Ar(5)*(2^40) + Ar(4)*(2^32) _
+ Ar(3)*(2^24) + Ar(2)*(2^16) + Ar(1)*(2^8) + Ar(0)
Days = Term/(1E7*86400)
WScript.Echo "ShutdownTime = " & CDate(DateSerial(1601, 1, 1) + Days) _
& " UTC"
Copy the above code to Notepad and save the file with ".vbs" extension. Double-click the script to run it.
Another way is to use the Registry Editor to export the above registry key to a file in .txt format (rather than .reg). This format shows the last write time of the key. When Windows updates the ShutdownTime value, the last write time of the key is updated. This is not a reliable way, as the last write time of a key changes when any other value under that key is changed.