How To Know the Last ShutDown Time Of Your Windows PC

Ads by Google

Problem – You have told your kid that he should not play on the computer till late at night. He should shut it down at 11 and then study since exams are near. He assures you that he will do that and next morning tells you that he did that.

How do you find out if he actually did that ?

If you want to know what was the exact last shutdown time of your computer, then you can find that out using a simple trick. You’d need to go to the Event Viewer in Windows to get that information.

Here are the steps.

Step1. If you are using Windows Vista or Windows 7, click the start icon and type Event Viewer in the search box. Event viewer program will appear. Click on it.

If you are a Windows XP user, Go to Start> Run. Type eventvwr.msc and click OK button.

Ads by Google

start menu

Step 2. Event Viewer window will open. Now on the left side of that window click on  “Windows Logs”. Now on the right side, click on System.


Step 3. All the system files will open on the right side. Now on the source column you have to find out Eventlog source having Event ID 6006 (6006 is an event ID for shutdown). You will find many Eventlog sources having event ID 6006. But you need to figure out source with the most recent date and time.

Note: All the events are placed in descending order (latest time first) so the top event log with event ID 6006 will show the correct time and date of last PC shutdown (In this case the time is 1/10/2010 1:06:48 AM).

event viewer

So the last shut down time of my PC is 1/10/2010 1:06:48 AM.

That’s how you can easily find out when exactly was your computer last shut down.

Get Guiding Tech articles delivered to your inbox.

We will never share your address. Unsubscribe at any time.

Post a Comment or Discuss at Guiding Tech Forums

Show archived comments (21)

Archived Comments

  1. Ramkumar says:

    Good one bro. When I was using windows98 I used to write a batch file to log in the start and shut down time of windows. That time never knew that there is a event viewer in windows 😀

  2. Abhijeet says:

    Quite right, Ram. Windows has come a long way since then.

  3. willdba says:

    What about cmd–>uptime?

  4. I use start –> run –> cmd and enter systeminfo | find “Up Time” to get how long my computer has been online. Most useful for servers though.

  5. Mario LaNasa says:

    net statistics server
    from a command prompt and gives you the date and time of last reboot.

    H:\>net statistics server
    Server Statistics for \\BALT-002553

    Statistics since 1/29/2010 8:25:27 AM

  6. Alan Price says:

    This is good to know, I have found the Event Viewer before, under the Administrative Tools in Vista, I forget if it is the same in XP Pro. I never knew what any of those Event Viewer “codes” meant, there has been several times that I have wanted to know how long it has been since I last closed or rebooted Windows.

    I used to use a RAM utility which sat in my task tray from OuterTechnology called CacheMan. It was a memory optimizer which returned physical RAM to be used by the system, and then helped to manage Virtual Memory, a utility that people with marginally low memory systems might find helpful to get the most out of their memory, but didn’t take the place of installing more Memory Modules wherever possible. I used the freeware version, they sold versions optimized for Windows XP and other specific memory configurations, but the free one was adequate for me. It always kept a very accurate clock of when I last booted windows down to the minute and second, and I checked it often.

    When CacheMan wasn’t available (specifically when I was forced to upgrade to Vista), I used the Network and Sharing Center where it kept a record of my Local Area Connection Status. There it kept a running clock since the last time my LAN Ethernet connection reached out to my Cable or DSL broadband connection which always automatically started at Windows Logon automatically. There is however an element of inaccuracy with this method, when figuring how long your system has been running since you last booted Windows up. If you don’t have a reliable internet connection, the clock may start over again when a connection is re-established. It has been so long since I’ve had that issue on a regular basis I can’t remember, but I think the clock starts over at 0:00 hours when the connection is interrupted, it is only a good time keeper if your connection is dependable.

    I sometimes keep my PC running for weeks at a time, if I don’t have to install any software or Windows updates which require a shutdown or reboot of Windows. That is why I am sometimes curious about my last shutdown time of Windows, because I almost always, except in rare instances, turn the computer immediately right back on. When I am not using this desktop unit, the monitor and hard drives, system, go into standby so they are using less resources and energy.

    Thank You for the explanation of how to use Event Log Notice 6006 to find out when I last shutdown Windows. I know I will find it useful.


    where do you find the free catcheman ? I tryed on the outer technology site. no results.. tks.

  8. Steven says:

    Or you can use a free program that get’s this information automatically for you and presents it in a nice graphical way. Pointstone PC Usage Viewer:

    • penny says:

      My event viewer recorded a user 32 1074 unexpected shut down this morning before i turned my laptop on! How is this possible? It had been turned off last properly before i went to bed?

  9. Ron says:

    Actually the event below the one that you point out is the shutdown event:

  10. Ram says:

    valuable information bro….

  11. rocky says:

    nice… i like it…

  12. Ashish says:

    Hello I am ashish Pundir. And I am 13 years old. And now I am very happy to read this and now I have no tension. Actually when my friends come then they open my pc with out my permission so I was very upset but now I am very happy.

  13. Bogdan Popet says:

    the shutdown event ID is acutally 13, not 6006.
    the system start event id is 12

  14. syed hasimul kabir rana says:

    really valuable topic for me. pls post more this type of topic.

  15. Binh Thanh Nguyen says:

    Thanks, nice post

  16. Cris S says:

    This information is incorrect, as is Bogdan Popet. I have no “event ID 13” on my system at all. Also someone entered my room yesterday and shut my computer down, yet there is no event 6006 for the time or date.

  17. Lance says:

    Very Helpfull Thanks !!!

  18. dan says:

    on vista 64 you can also select “user 32” and search for event id “1074”