How To Know the Last ShutDown Time Of Your Windows PC

Ads by Google

Problem – You have told your kid that he should not play on the computer till late at night. He should shut it down at 11 and then study since exams are near. He assures you that he will do that and next morning tells you that he did that.

How do you find out if he actually did that ?

If you want to know what was the exact last shutdown time of your computer, then you can find that out using a simple trick. You’d need to go to the Event Viewer in Windows to get that information.

Here are the steps.

Step1. If you are using Windows Vista or Windows 7, click the start icon and type Event Viewer in the search box. Event viewer program will appear. Click on it.

If you are a Windows XP user, Go to Start> Run. Type eventvwr.msc and click OK button.

Ads by Google

start menu

Step 2. Event Viewer window will open. Now on the left side of that window click on  “Windows Logs”. Now on the right side, click on System.


Step 3. All the system files will open on the right side. Now on the source column you have to find out Eventlog source having Event ID 6006 (6006 is an event ID for shutdown). You will find many Eventlog sources having event ID 6006. But you need to figure out source with the most recent date and time.

Note: All the events are placed in descending order (latest time first) so the top event log with event ID 6006 will show the correct time and date of last PC shutdown (In this case the time is 1/10/2010 1:06:48 AM).

event viewer

So the last shut down time of my PC is 1/10/2010 1:06:48 AM.

That’s how you can easily find out when exactly was your computer last shut down.

Get Guiding Tech articles delivered to your inbox.

We will never share your address. Unsubscribe at any time.

  • Ramkumar

    Good one bro. When I was using windows98 I used to write a batch file to log in the start and shut down time of windows. That time never knew that there is a event viewer in windows 😀

  • Abhijeet

    Quite right, Ram. Windows has come a long way since then.

  • Pingback: How To Know When Your Computer Last Shut Down :: TinyHacker()

  • willdba

    What about cmd–>uptime?

  • Curtis LaMasters

    I use start –> run –> cmd and enter systeminfo | find “Up Time” to get how long my computer has been online. Most useful for servers though.

  • Pingback: Use Event Viewer to Tell When Your PC Last Rebooted [Windows Tip] · TechBlogger()

  • Mario LaNasa

    net statistics server
    from a command prompt and gives you the date and time of last reboot.

    H:\>net statistics server
    Server Statistics for \\BALT-002553

    Statistics since 1/29/2010 8:25:27 AM

  • Pingback: Use Event Viewer to Tell When Your PC Last Rebooted [Windows Tip] | Son Of Byte()

  • Pingback: Use Event Viewer To Tell When Your PC Last Rebooted | Lifehacker Australia()

  • Pingback: Use Event Viewer to Tell When Your PC Last Rebooted [Windows Tip] | Computer Tips and Tricks()

  • Pingback: Use Event Viewer to Tell When Your PC Last Rebooted [Windows Tip] « Coolbeans()

  • Alan Price

    This is good to know, I have found the Event Viewer before, under the Administrative Tools in Vista, I forget if it is the same in XP Pro. I never knew what any of those Event Viewer “codes” meant, there has been several times that I have wanted to know how long it has been since I last closed or rebooted Windows.

    I used to use a RAM utility which sat in my task tray from OuterTechnology called CacheMan. It was a memory optimizer which returned physical RAM to be used by the system, and then helped to manage Virtual Memory, a utility that people with marginally low memory systems might find helpful to get the most out of their memory, but didn’t take the place of installing more Memory Modules wherever possible. I used the freeware version, they sold versions optimized for Windows XP and other specific memory configurations, but the free one was adequate for me. It always kept a very accurate clock of when I last booted windows down to the minute and second, and I checked it often.

    When CacheMan wasn’t available (specifically when I was forced to upgrade to Vista), I used the Network and Sharing Center where it kept a record of my Local Area Connection Status. There it kept a running clock since the last time my LAN Ethernet connection reached out to my Cable or DSL broadband connection which always automatically started at Windows Logon automatically. There is however an element of inaccuracy with this method, when figuring how long your system has been running since you last booted Windows up. If you don’t have a reliable internet connection, the clock may start over again when a connection is re-established. It has been so long since I’ve had that issue on a regular basis I can’t remember, but I think the clock starts over at 0:00 hours when the connection is interrupted, it is only a good time keeper if your connection is dependable.

    I sometimes keep my PC running for weeks at a time, if I don’t have to install any software or Windows updates which require a shutdown or reboot of Windows. That is why I am sometimes curious about my last shutdown time of Windows, because I almost always, except in rare instances, turn the computer immediately right back on. When I am not using this desktop unit, the monitor and hard drives, system, go into standby so they are using less resources and energy.

    Thank You for the explanation of how to use Event Log Notice 6006 to find out when I last shutdown Windows. I know I will find it useful.

    • Abhijeet

      I am glad you found it useful, Alan. Keep reading. :)


    where do you find the free catcheman ? I tryed on the outer technology site. no results.. tks.

  • Steven

    Or you can use a free program that get’s this information automatically for you and presents it in a nice graphical way. Pointstone PC Usage Viewer:

    • penny

      My event viewer recorded a user 32 1074 unexpected shut down this morning before i turned my laptop on! How is this possible? It had been turned off last properly before i went to bed?

  • Pingback: links for 2010-03-11 « LAN b4 Time()

  • Pingback: Analyze and Fix Windows 7 Problems Using Reliability Monitor()

  • Ron

    Actually the event below the one that you point out is the shutdown event:

  • Ram

    valuable information bro….

  • rocky

    nice… i like it…

  • Ashish

    Hello I am ashish Pundir. And I am 13 years old. And now I am very happy to read this and now I have no tension. Actually when my friends come then they open my pc with out my permission so I was very upset but now I am very happy.

  • Bogdan Popet

    the shutdown event ID is acutally 13, not 6006.
    the system start event id is 12

    • ee

      its 6006 on 64 bit

  • syed hasimul kabir rana

    really valuable topic for me. pls post more this type of topic.

  • Binh Thanh Nguyen

    Thanks, nice post

  • Cris S

    This information is incorrect, as is Bogdan Popet. I have no “event ID 13″ on my system at all. Also someone entered my room yesterday and shut my computer down, yet there is no event 6006 for the time or date.

  • Lance

    Very Helpfull Thanks !!!

  • dan

    on vista 64 you can also select “user 32″ and search for event id “1074”