While using Windows 11, sometimes you may want to check your PC’s Startup and shutdown history. There could be various reasons you would like to check when a computer booted up or shut down history. For example, if you share your PC with your family, you may want to track the startup/shutdown history to know if someone has used your PC in your absence.
Yes, there could be other reasons, such as while troubleshooting BSOD errors, the technician might ask you to provide this report. Whatever the reason, you can quickly check your Startup and Shutdown history on Windows 11.
Hence, this article will share the best methods to check your Startup and Shutdown history on Windows 11. The methods will be straightforward; follow them as mentioned below. Let’s get started.
1. Track Startup & Shutdown History via Event Viewer
We will use the Windows Event Viewer utility to track the Startup & shutdown history in this method. Here are some of the simple steps that you need to follow.
1. Click the Windows 11 search and type in Event Viewer. Next, open Event Viewer from the list of matching options.
2. On the Event Viewer, navigate to the Windows Logs > System.
3. Double click the Filter Current Log.. option on the right pane, as shown below.
4. On the Filter Current Log window, you must type the Event ID to check the Startup and shutdown logs. For that, enter the IDs 6005 and 6006. Once you’ve done that, click the Ok button.
- ID 6005: This showed the event log when it was started (Windows 11 Startup)
- ID 6006: This shows when the event log has stopped (Windows 11 Shutdown)
5. Now, you will see all your Startup and Shutdown history of Windows 11.
Other Event ID to look for?
In addition to these two, you need to look at the following ID numbers to check the startup and shutdown history.
41: This event is triggered when the device doesn’t restart correctly using the clean shutdown first. You will see this if your PC stops responding, crashes, or loses power unexpectedly.
1074: This event is triggered when a manual shutdown or restart is initiated. You will also notice it when your PC restarts automatically to apply updates.
6008: This event indicates that the previous device shutdown was unexpected. If the Event ID 41 appears, you will also see 6008.
2. Check Startup & Shutdown History via Command Prompt
In this method, we will use the Command Prompt utility of Windows 11 to check the Startup & Shutdown history. Here are some of the simple steps you need to follow.
1. First, click on the Windows 11 search and type in Command Prompt. Next, right-click on the Command Prompt and select Run as administrator.
2. If you want to check the Startup history, execute the command:
wevtutil qe system "/q:*[System [(EventID=6005)]]" /rd:true /f:text /c:1 | findstr /i "date"
3. If you wish to check the Shutdown history, execute the command:
wevtutil qe system "/q:*[System [(EventID=6006)]]" /rd:true /f:text /c:1 | findstr /i "date"
This is how you can check the Startup & Shutdown history on Windows 11 via the Command Prompt utility.
It’s pretty easy to check your Startup and shutdown history on the Windows 11 operating system. You can also use third-party apps to track the same thing, but third-party apps also collect data from your Event Viewer. So, it doesn’t make sense to use third-party apps to check the Startup & Shutdown history on Windows 11.
