Windows 11 keeps a log of startup and shutdown process of your PC. You can check the number of times you have started up and shut down your computer with time and date. The startup and shutdown history in Windows 11 can be helpful for both personal and professional purposes. This data could help you monitor unauthorized access to your device, and it is also required when troubleshooting BSOD errors.
It is easy to see the startup and shutdown history in Windows 11. You can use the Event Viewer tool and Command Prompt to check the data. And this history can be useful in various scenarios. For instance, you may want to know how many times someone has booted up or powered off your computer in your absent.
Additionally, when troubleshooting Blue Screen of Death (BSOD) errors, a technician may request the start-up and shutdown count to aid in their investigation. The startup and shutdown data of your Windows 11 computer will provide valuable insights into the stability and usage patterns of your system. It will show time, date and reasons of startup and shutdown.
Follow the step-by-step guide to check the bootup and shutdown history of your Windows 11 PC
Contents
How to View Startup and Shutdown History of Windows 11 PC?
1. First, type “Event Viewer” in the Windows 11 search box and open the Event Viewer app from the search result.
2. On Event Viewer, select Windows Logs and click System.
3. Next, double-click on “Filter Current Log” option on the right pane of the Even Viewer window.
4. Now, enter the Event IDs 6005 and 6006 on “Filter Current Log” window and click OK.
5. You will see all your start-up and shutdown history of Windows 11. Event ID 6005 will display Windows 11 start-up log and event ID 6006 will display Windows 11 shutdown log.
The event IDs mentioned above indicate normal Windows startup and shutdown history. For unexpected shutdowns due to errors like Blue Screen of Death (BSOD), restarts, partial shutdowns, system crashes, and so on, you will need to look for other event IDs. For example, event ID 1074 is triggered when a manual shutdown or restart is initiated, such as a restart after applying a system update. Event ID 6008 indicates that the previous shutdown was unexpected.
In addition to the Event Viewer, you can also use the Command Prompt to check the startup and shutdown history of your Windows 11 PC. If you are comfortable using the Command Prompt, here’s how you can do it:
How to Check Startup and Shutdown Data Using Command Prompt in Windows 11?
1. First, open Command Prompt as administrator on your Windows 11 PC.
2. Next, to check the startup data, type the command:
wevtutil qe system “/q:*[System [(EventID=6005)]]” /rd:true /f:text /c:1 | findstr /i “date” and press Enter.
3. To check the shutdown history, type the command wevtutil qe system “/q:*[System [(EventID=6006)]]” /rd:true /f:text /c:1 | findstr /i “date” and press Enter key.
This is how you can check the startup and shutdown history on Windows 11 using Event View app and Command Prompt utility.
