Startup and Shutdown History in Windows 11: Find Out Who Used It! 🕵️‍♂️

When using Windows 11, you may want to review your PC's startup and shutdown history at some point. There are several reasons why you might need to know when a computer was turned on or off. For example, if you share your PC with your family, you might want to track this history to see if anyone used it while you were away. 🖥️

Of course, there are other reasons, such as when a technician needs to review the history to troubleshoot a blue screen error (BSOD). Whatever the reason, you can easily check the boot and shutdown history in Windows 11. 😉

So, in this article, I will share with you the best methods to check the startup and shutdown history in Windows 11. The steps are simple; follow them as indicated below. Let's get started! 🚀

1. Trace boot and shutdown history through Event Viewer

Let's use the tool Event Viewer Windows to track startup and shutdown history in this method. Here are some simple steps to follow.

1. Click on the Windows 11 search box and type "Event Viewer." Then, open Event Viewer from the list of options that appears.

2. In the Event Viewer, navigate to Windows Logs > System.

3. Double-click on the option Filter current record.. in the right panel, as shown below.

4. In the Filter Current Log window, you need to enter the event IDs to check the startup and shutdown logs. To do this, enter the IDs 6005 and 6006. Once this is done, click on the button Ok.

• ID 6005: This ID shows the record of the event when the system was started (Windows Startup 11).
• ID 6006: This ID indicates when the event log stopped (Windows 11 Shutdown).

5. Now, you will be able to see all your boot and shutdown history of Windows 11.

Other event IDs to review?

Aside from these two, you also need to look at the following ID numbers to check the boot and shutdown history.

41: This event is triggered when the device doesn't restart properly using a clean shutdown first. You'll see it if your PC stops responding, crashes, or unexpectedly loses power.

1074: This event is triggered when a manual shutdown or restart is initiated. You'll also notice this when your PC automatically restarts to apply updates.

6008: This event indicates that the previous device shutdown was unexpected. If Event ID 41 is present, you'll also see Event ID 6008.

2. Check boot and shutdown history via Command Prompt

In this method, we are going to use the tool of the Windows Command Prompt 11 to check the startup and shutdown history. Here are some simple steps to follow.

1. First, click on the search engine Windows 11 and I wrote Command Prompt. Then, right-click on the Command Prompt and select Run as administrator.

2. If you want to review the boot history, run the command:

wevtutil qe system "/q:*[System [(EventID=6005)]]" /rd:true /f:text /c:1 | findstr /i "date"

3. If you want to check the shutdown history, run the following command:

wevtutil qe system "/q:*[System [(EventID=6006)]]" /rd:true /f:text /c:1 | findstr /i "date"

This is how you can Check the startup and shutdown history in Windows 11 via the Command Prompt tool.

It's fairly easy to review your startup and shutdown history in Windows 11. You can also use third-party apps to track the same, but these apps also collect data from your Event Viewer. Therefore, there's no point in using external apps to check startup and shutdown history in Windows 11. 🤷‍♂️