{"id":570,"date":"2008-09-09T10:46:15","date_gmt":"2008-09-09T10:46:15","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=570"},"modified":"2020-06-20T13:15:21","modified_gmt":"2020-06-20T13:15:21","slug":"how-to-determine-the-last-shutdown-date-and-time-in-windows","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/how-to-determine-the-last-shutdown-date-and-time-in-windows\/","title":{"rendered":"How to Determine the Last Shutdown Time and Date in Windows"},"content":{"rendered":"

The easiest way to determine the last shutdown date and time is to check the event logs. When you shut down a computer Event ID 1074 is written to the event log which denotes a clean shutdown. The following instructions apply all versions of Windows, including Windows 10.<\/p>\n

Determine the Last Shutdown or Restart Date & Time in Windows<\/h2>\n

To find when was a computer last shutdown, check the Event Viewer for the most recent Event ID 1074.<\/p>\n

    \n
  1. Run eventvwr.msc<\/b> to start the Event Viewer.<\/li>\n
  2. In the Event Viewer, expand Windows Logs \u2192 System<\/b><\/li>\n
  3. Sort the log by Date (descending)<\/li>\n
  4. Click Filter Current Log… on the right pane.<\/li>\n
  5. Add event id: 1074<\/code> in the Includes list, and enable all event types.
    \n\"determine<\/li>\n
  6. Click OK.<\/li>\n<\/ol>\n

    Here’s a sample shutdown event:<\/p>\n

    Log Name: System\r\nSource: User32\r\nDate: 2019-06-25T00:15:05.230\r\nEvent ID: 1074<\/strong>\r\nTask: N\/A\r\nLevel: Information\r\nOpcode: N\/A\r\nKeyword: Classic\r\nUser Name: DESKTOP-JKJ4G5Q\\ramesh\r\nComputer: DESKTOP-JKJ4G5Q\r\nDescription: \r\nThe process C:\\Windows\\System32\\RuntimeBroker.exe (DESKTOP-JKJ4G5Q) has initiated the power off of computer DESKTOP-JKJ4G5Q on behalf of user DESKTOP-JKJ4G5Q\\ramesh for the following reason: Other (Unplanned)\r\n Reason Code: 0x0\r\n Shutdown Type: power off<\/strong><\/pre>\n
    Find last shutdown time using Command-line<\/h4>\n
    To retrieve the most recent shutdown event (Event ID 1074) from the System<\/strong> event log using command-line, run this command:<\/p>\n
    wevtutil qe system \"\/q:*[System [(EventID=1074)]]\" \/rd:true \/f:text \/c:1<\/pre>\n
    \"find<\/p>\n
    To view only the date (timestamp) of the event without other details, run:<\/p>\n
    wevtutil qe system \"\/q:*[System [(EventID=1074)]]\" \/rd:true \/f:text \/c:1 | findstr \/i \"date\"<\/pre>\n
    RELATED:<\/strong> Different ways to find the Uptime in Windows<\/a><\/div>\n
    Event ID 6005 and 6006<\/h3>\n
    Alternately, you can also look for Event ID 6006 “The Event log service was stopped.” and 6005 “The Event log service was started.” which denotes that a shutdown or a restart event had taken place at the specified time.<\/p>\n
    \"determine<\/p>\n
    RELATED:<\/strong> How to Find the Windows Installation Date and Time<\/a><\/div>\n
    Using Windows Script and registry<\/h3>\n
    Windows also stores the last shutdown date and time in a REG_BINARY value named ShutdownTime<\/code> in the following branch:<\/p>\n
    HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Windows<\/pre>\n
    Note:<\/strong> This method shows the correct last shutdown time only if Fast Startup<\/strong> is not being used.<\/h4>\n
    To convert the Binary data to readable form, you may use the following VBScript.<\/p>\n
    'Determine the last shutdown time and date in Windows 10 and earlier\r\nstrValueName = \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Windows\\\" _\r\n  & \"ShutdownTime\"\r\nSet oShell = CreateObject(\"WScript.Shell\")\r\nAr = oShell.RegRead(strValueName)\r\nTerm = Ar(7)*(2^56) + Ar(6)*(2^48) + Ar(5)*(2^40) + Ar(4)*(2^32) _\r\n+ Ar(3)*(2^24) + Ar(2)*(2^16) + Ar(1)*(2^8) + Ar(0)\r\nDays = Term\/(1E7*86400)\r\nWScript.Echo \"ShutdownTime = \" & CDate(DateSerial(1601, 1, 1) + Days) _\r\n & \" UTC\"\r\n<\/pre>\n
    Copy the above code to Notepad and save the file with .vbs<\/code> extension. Double-click the script to run it.<\/p>\n
    \"determine<\/p>\n
    Another way is to use the Registry Editor to export the following registry key to a file into a .txt file (instead of .reg).<\/p>\n
    HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Windows<\/pre>\n
    Exporting the key to a .txt file shows the last write time of the key. When Windows updates the ShutdownTime<\/b> registry value, the last write time of the key is updated.<\/p>\n
    \"determine<\/p>\n","protected":false},"excerpt":{"rendered":"
    The easiest way to determine the last shutdown date and time is to check the event logs. When you shut down a computer Event ID 1074 is written to the event log which denotes a clean shutdown. The following instructions apply all versions of Windows, including Windows 10.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[7],"tags":[441,480],"class_list":["post-570","post","type-post","status-publish","format-standard","hentry","category-windows","tag-registry","tag-scripts"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":10260,"url":"https:\/\/www.winhelponline.com\/blog\/vss-event-log-errors-windows-10-event-ids-8193-and-13\/","url_meta":{"origin":570,"position":0},"title":"VSS Event Log Errors: Event IDs 8193 and 13","author":"Ramesh","date":"July 9, 2019","format":false,"excerpt":"After upgrading to Windows 10 v1903, two VSS error entries appear in the Application event log during every shutdown. The Event IDs are 8193 and 13 with the event source as VSS. Along with the two error logs, an informational event (ID: 8224) is also recorded during the user session\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"event viewer error - event id 8193","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/vss-error-8193-event-log.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/vss-error-8193-event-log.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/vss-error-8193-event-log.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":10415,"url":"https:\/\/www.winhelponline.com\/blog\/windows-logs-off-user-when-shutdown-or-hibernate\/","url_meta":{"origin":570,"position":1},"title":"Windows Logs Off when Shutdown or Hibernate is used","author":"Ramesh","date":"July 20, 2019","format":false,"excerpt":"Over these years, at least since the Windows 7 era, we've seen several cases where the system logs you off when clicking on the Shutdown or Hibernate option in the Start menu. The problem may be seen in Windows 8, Windows 10, or 11 systems as well. What causes Windows\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"dumpfilters registry value","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/dumpfilters-registry.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/dumpfilters-registry.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/dumpfilters-registry.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":50678,"url":"https:\/\/www.winhelponline.com\/blog\/export-event-logs-event-viewer\/","url_meta":{"origin":570,"position":2},"title":"How to Export Windows Event Logs from Event Viewer","author":"Ramesh","date":"June 1, 2023","format":false,"excerpt":"The Windows Event logs provide very valuable information for diagnosing problems on the computer. Event logs store records of significant events on behalf of the system and applications running on the system. This article tells you how to export the event logs to a file using the Event Viewer or\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"export event logs evtx - locale metadata","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/export-event-log-3.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/export-event-log-3.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/export-event-log-3.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/export-event-log-3.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":19493,"url":"https:\/\/www.winhelponline.com\/blog\/jump-directly-to-specific-event-log-eventvwr\/","url_meta":{"origin":570,"position":3},"title":"How to Jump to a Specific Event Log (Channel) Directly in Event Viewer","author":"Ramesh","date":"October 24, 2020","format":false,"excerpt":"The event logging service in Windows records important software and hardware events from various sources and stores them in a collection named event log. There are various event log channels in addition to the well-known built-in channels like Application, System, Security, etc.\u00a0The Event Viewer (eventvwr.msc or eventvwr.exe) enables you to\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"eventvwr command-line parameters list","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/eventvwr-commandline.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/eventvwr-commandline.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/eventvwr-commandline.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":75211,"url":"https:\/\/www.winhelponline.com\/blog\/how-to-read-chkdsk-log-event-viewer\/","url_meta":{"origin":570,"position":4},"title":"How to Read Chkdsk Log in the Event Viewer","author":"Ramesh","date":"May 16, 2024","format":false,"excerpt":"The Chkdsk utility checks the file system and file system metadata of a volume for logical and physical errors and repairs them. When you run Chkdsk c: \/r and schedule it for the next boot, Chkdsk runs the scan during the next boot. The results of the Chkdsk operation is\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"windows event log - filter current log","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/05\/chkdsk-event-log-wininit-chkdsk.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/05\/chkdsk-event-log-wininit-chkdsk.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/05\/chkdsk-event-log-wininit-chkdsk.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/05\/chkdsk-event-log-wininit-chkdsk.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":893,"url":"https:\/\/www.winhelponline.com\/blog\/clear-task-scheduler-history-windows\/","url_meta":{"origin":570,"position":5},"title":"How to Clear Task Scheduler History in Windows","author":"Ramesh","date":"April 23, 2009","format":false,"excerpt":"Task Scheduler in Windows tracks events for each scheduled task when the task history option is enabled for the task. The task history can be viewed by opening the task properties and clicking the History tab. The entries are stored in the Microsoft-Windows-TaskScheduler event log. Use the instructions in this\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"clear task scheduler history in event log","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/04\/clear-scheduled-tasks-history.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/04\/clear-scheduled-tasks-history.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/04\/clear-scheduled-tasks-history.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/04\/clear-scheduled-tasks-history.png?resize=700%2C400&ssl=1 2x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/570","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=570"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/570\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=570"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=570"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=570"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}