The easiest way to determine the last shutdown date/time is to check the event logs. When you shutdown a computer Event ID 6006 is written to the Event log which denotes a clean shutdown. Here is a sample event.

Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6006
Date: 9/8/2008
Time: 3:35:20 PM
User: N/A
Computer: MYCOMP
Description:
The Event log service was stopped.

Ref: Windows Event IDs 6005, 6006, 6008, and 6009.

1. Launch Eventvwr.msc to start the Event Viewer.

2. Click System

Note: In Windows Vista, you need to double-click Windows Logs, and select System.

3. Sort the results by Date (descending)

4. Locate the most recent entry with the ID of 6006 and the Source column reading eventlog

5. Note down the date and time of that entry. This is the last shutdown time.

Note: Windows Vista also writes event 1074 (STATUS_SHUTDOWN_CLEAN) when shut down.

Using the registry

Windows also stores the last shutdown date and time in a REG_BINARY value named ShutdownTime in the following branch:

HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Windows

To convert the Binary data to readable form, you may use the script from VisualBasicScript.com.

strValueName = "HKLM\SYSTEM\CurrentControlSet\Control\Windows\" _
& "ShutdownTime"
Set oShell = CreateObject("WScript.Shell")
Ar = oShell.RegRead(strValueName)
Term = Ar(7)*(2^56) + Ar(6)*(2^48) + Ar(5)*(2^40) + Ar(4)*(2^32) _
+ Ar(3)*(2^24) + Ar(2)*(2^16) + Ar(1)*(2^8) + Ar(0)
Days = Term/(1E7*86400)
WScript.Echo "ShutdownTime = " & CDate(DateSerial(1601, 1, 1) + Days) _
& " UTC"

Copy the above code to Notepad and save the file with ".vbs" extension. Double-click the script to run it.

Another way is to use the Registry Editor to export the above registry key to a file in .txt format (rather than .reg). This format shows the last write time of the key. When Windows updates the ShutdownTime value, the last write time of the key is updated. This is not a reliable way, as the last write time of a key changes when any other value under that key is changed.

See also

How to determine the system uptime in Windows Vista


Email SubscriptionPrefer an E-mail subscription?

Enter your email address:

Delivered by FeedBurner

One Comment

  1. said this on Saturday, September 17th 2011 1:14 pm

    strValueName = “HKLM\SYSTEM\CurrentControlSet\Control\Windows\” _
    & “ShutdownTime”
    Set oShell = CreateObject(“WScript.Shell”)
    Ar = oShell.RegRead(strValueName)
    Term = Ar(7)*(2^56) + Ar(6)*(2^48) + Ar(5)*(2^40) + Ar(4)*(2^32) _
    + Ar(3)*(2^24) + Ar(2)*(2^16) + Ar(1)*(2^8) + Ar(0)
    Days = Term/(1E7*86400)
    WScript.Echo “ShutdownTime = ” & CDate(DateSerial(1601, 1, 1) + Days) _
    & ” UTC”

    Nte:-This script not given the right shutdown time.

Leave a Reply