How to Quickly Track Shutdown and Restart details


  1. Go to Start > Click Run.
  2. Type in Eventvwr.msc and hit enter.evnt
  3. Event Viewer console will open up.
  4. Under the left Hierarchy tree > Select Windows logs > System
  5. Once you select ‘System‘ , Right click it .
  6. A menu will pop up, select ‘Filter Current Log‘ .
    filt
  7. A new ‘filter current log‘ dialogue box will appear.
  8. Under the highlighted box, type in Event Id’s 1074, 6008

    Event ID 1074 : USER32 events, are generated whenever a user Shutdown/Reboots the machine.
    Event ID 6008     : EventLog events, are generated henever machine crashes or abruptly Shutdown/Restart.    evnt

  9. Click OK button, at bottom of the dialogue box.
  10. You will observe that only event id 1074 and 6008 are selected, rest are filtered out.
    evnt
  11. You will see a description at the bottom of the window, with detailed information about this shutdown/restart event.
  12. If you don’t remember the Event Id’s, no issues 😉 – You can directly filter the USER32 and EventLog events under the Event Sources drop down menu, in the ‘Filter current log‘ dialogue box.

~ For more detailed ways to track uptime of a machine follow this Link .

Happy Learning !

4 thoughts on “How to Quickly Track Shutdown and Restart details”

    1. Hello Rohit,

      Knowing when and how the server was rebooted helps you understand & troubleshoot better in case of any abrupt shutdown or crash, as you can identify the eventlog related to that which might have some useful information like which process initiated the power cycle (under EVENTLOG) or name of the user who restarted the machine ( under USER32 event )

      I think for the Patch management , we’ve to make sure that machine is rebooted after the patch installation otherwise pathes won’t apply.
      So to know the last reboot time, Analysing event viewer isn’t the best thing we can do and to achieve this you can use the following ways-

      1. Use the Uptime utility in cmd prompt : CMD > type ‘uptime’ once you have uptime.exe copied to C:\Windows\System32

      Download it from below link – http://uptimeexe.codeplex.com/

      2. Go to Network Settings > Right click on the server NIC > Status > You will see a clock running, this is clock gets reset every time machine reboots.

      3. Use WMI query in powerhsell to know the last reboot time.

      I guess there could me more ways to know the last reboot time, Please share if you find more 🙂

      Happy reading 🙂

      Like

Leave a comment