Skip to main content

Windows Startup and Shutdown Events

· One min read

Event Viewer​

  • Run eventvwr.msc
  • Windows Logs ▶ System ▶ Filter Current Log...

PowerShell​

# Get-EventLog System | ? EventID -In (<Event ID>, ...)
Get-EventLog System | ? EventID -In (6005, 6006)

Event ID​

  • 1074: Which process initiate the shutdown / reboot
  • 6005: The Event log service was started
  • 6006: The Event log service was stopped
  • 6008: The previous system shutdown was unexpected
  • 6013: The system uptime