How to Determine the Last Shutdown Time and Date in Windows

The easiest way to determine the last shutdown date and time is to check the event logs. When you shut down a computer Event ID 1074 is written to the event log which denotes a clean shutdown. The following instructions apply all versions of Windows, including Windows 10.

Determine the Last Shutdown or Restart Date & Time in Windows

To find when was a computer last shutdown, check the Event Viewer for the most recent Event ID 1074.

1. Run eventvwr.msc to start the Event Viewer.
2. In the Event Viewer, expand Windows Logs → System
3. Sort the log by Date (descending)
4. Click Filter Current Log… on the right pane.
5. Add event id: 1074 in the Includes list, and enable all event types.
   
6. Click OK.

Here’s a sample shutdown event:

Log Name: System
Source: User32
Date: 2019-06-25T00:15:05.230
Event ID: 1074
Task: N/A
Level: Information
Opcode: N/A
Keyword: Classic
User Name: DESKTOP-JKJ4G5Q\ramesh
Computer: DESKTOP-JKJ4G5Q
Description: 
The process C:\Windows\System32\RuntimeBroker.exe (DESKTOP-JKJ4G5Q) has initiated the power off of computer DESKTOP-JKJ4G5Q on behalf of user DESKTOP-JKJ4G5Q\ramesh for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off

Find last shutdown time using Command-line

To retrieve the most recent shutdown event (Event ID 1074) from the System event log using command-line, run this command:

wevtutil qe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1

To view only the date (timestamp) of the event without other details, run:

wevtutil qe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1 | findstr /i "date"

Event ID 6005 and 6006

Alternately, you can also look for Event ID 6006 “The Event log service was stopped.” and 6005 “The Event log service was started.” which denotes that a shutdown or a restart event had taken place at the specified time.

Using Windows Script and registry

Windows also stores the last shutdown date and time in a REG_BINARY value named ShutdownTime in the following branch:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows

Note: This method shows the correct last shutdown time only if Fast Startup is not being used.

To convert the Binary data to readable form, you may use the following VBScript.

'Determine the last shutdown time and date in Windows 10 and earlier
strValueName = "HKLM\SYSTEM\CurrentControlSet\Control\Windows\" _
  & "ShutdownTime"
Set oShell = CreateObject("WScript.Shell")
Ar = oShell.RegRead(strValueName)
Term = Ar(7)*(2^56) + Ar(6)*(2^48) + Ar(5)*(2^40) + Ar(4)*(2^32) _
+ Ar(3)*(2^24) + Ar(2)*(2^16) + Ar(1)*(2^8) + Ar(0)
Days = Term/(1E7*86400)
WScript.Echo "ShutdownTime = " & CDate(DateSerial(1601, 1, 1) + Days) _
 & " UTC"

Copy the above code to Notepad and save the file with .vbs extension. Double-click the script to run it.

Another way is to use the Registry Editor to export the following registry key to a file into a .txt file (instead of .reg).

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows

Exporting the key to a .txt file shows the last write time of the key. When Windows updates the ShutdownTime registry value, the last write time of the key is updated.