How to Determine the Last Shutdown Time and Date in Windows

The easiest way to determine the last shutdown date and time is to check the event logs. When you shut down a computer Event ID 1074 is written to the event log which denotes a clean shutdown. The following instructions apply all versions of Windows, including Windows 10.

Determine the Last Shutdown or Restart Date & Time in Windows

To find when was a computer last shutdown, check the Event Viewer for the most recent Event ID 1074.

  1. Run eventvwr.msc to start the Event Viewer.
  2. In the Event Viewer, expand Windows Logs → System
  3. Sort the log by Date (descending)
  4. Click Filter Current Log… on the right pane.
  5. Add event id: 1074 in the Includes list, and enable all event types.
    determine shutdown time windows - event log 1074
  6. Click OK.

Here’s a sample shutdown event:

Log Name: System
Source: User32
Date: 2019-06-25T00:15:05.230
Event ID: 1074
Task: N/A
Level: Information
Opcode: N/A
Keyword: Classic
User Name: DESKTOP-JKJ4G5Q\ramesh
Computer: DESKTOP-JKJ4G5Q
Description: 
The process C:\Windows\System32\RuntimeBroker.exe (DESKTOP-JKJ4G5Q) has initiated the power off of computer DESKTOP-JKJ4G5Q on behalf of user DESKTOP-JKJ4G5Q\ramesh for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off

Find last shutdown time using Command-line

To retrieve the most recent shutdown event (Event ID 1074) from the System event log using command-line, run this command:

wevtutil qe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1

find last shutdown time windows - wevtutil

To view only the date (timestamp) of the event without other details, run:

wevtutil qe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1 | findstr /i "date"

Event ID 6005 and 6006

Alternately, you can also look for Event ID 6006 “The Event log service was stopped.” and 6005 “The Event log service was started.” which denotes that a shutdown or a restart event had taken place at the specified time.

determine shutdown time windows - event log 6006 6005

Using Windows Script and registry

Windows also stores the last shutdown date and time in a REG_BINARY value named ShutdownTime in the following branch:



HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows

Note: This method shows the correct last shutdown time only if Fast Startup is not being used.

To convert the Binary data to readable form, you may use the following VBScript.

'Determine the last shutdown time and date in Windows 10 and earlier
strValueName = "HKLM\SYSTEM\CurrentControlSet\Control\Windows\" _
  & "ShutdownTime"
Set oShell = CreateObject("WScript.Shell")
Ar = oShell.RegRead(strValueName)
Term = Ar(7)*(2^56) + Ar(6)*(2^48) + Ar(5)*(2^40) + Ar(4)*(2^32) _
+ Ar(3)*(2^24) + Ar(2)*(2^16) + Ar(1)*(2^8) + Ar(0)
Days = Term/(1E7*86400)
WScript.Echo "ShutdownTime = " & CDate(DateSerial(1601, 1, 1) + Days) _
 & " UTC"

Copy the above code to Notepad and save the file with .vbs extension. Double-click the script to run it.

determine shutdown time windows - windows scripting

Another way is to use the Registry Editor to export the following registry key to a file into a .txt file (instead of .reg).

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows

Exporting the key to a .txt file shows the last write time of the key. When Windows updates the ShutdownTime registry value, the last write time of the key is updated.

determine shutdown time windows - windows registry


One small request: If you liked this post, please share this?

One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
  • Pin it!
  • Share it to your favorite blog + Facebook, Reddit
  • Tweet it!
So thank you so much for your support. It won't take more than 10 seconds of your time. The share buttons are right below. :)

Ramesh Srinivasan is passionate about Microsoft technologies and he has been a consecutive ten-time recipient of the Microsoft Most Valuable Professional award in the Windows Shell/Desktop Experience category, from 2003 to 2012. He loves to troubleshoot and write about Windows. Ramesh founded Winhelponline.com in 2005.

3 thoughts on “How to Determine the Last Shutdown Time and Date in Windows”

  1. Thanks for the article. I always find that the best way to check for when the last shutdown might have been though, is to check the internet browser history for the last page visited before the shutdown, especially if this was on the previous day or night, as that gives a rough time of when you might have last shut down the computer or laptop. This is only really useful if one of the last things you did was surf the web, using that internet browser, but it works fairly well and is easy to check.

    Reply

Leave a Comment