To stay up to date, remember to subscribe to our YouTube channel!
SUBSCRIBE ON YOUTUBE
One of the tasks we do on a daily basis is turning our PC on and off, this is something natural to work on it and its applications and turn it off so that it does not affect the useful life of the components or to affect aspects such as energy consumption, but there are times when it is necessary to have access to the log both on and off and some of them are:
Registration Recommendations
- Sudden shutdowns due to driver or system errors
- Unauthorized turning off or turning on
TechnoWikis will explain in this tutorial various ways to access these records and thus have administrative control of this segment..
1 View Windows 11 power on and shutdown log from Event Viewer
Without a doubt, this is one of the most used options to review everything that happens with the system turning on and off, since when doing this an ID or identifier is stored with details of what happened.
Step 1
For this case we open the Event Viewer from the Start menu:
Step 2
In the viewer console we go to the "Windows Logs" section and then we go to "System", we hope they load all the associated events:
Step 3
Here it is possible to click on the column "Id. of the event” to organize the events from smallest to largest:
To apply a more direct result, we are going to click on "Filter current record" on the side to see the following:
Step 4
We must keep in mind which are the most common IDs associated with turning off and on in Windows 11, these are:
common ids
- Event 41: "The system has rebooted without shutting down first", indicates that the PC has been rebooted without a graceful shutdown.
- Event 6006: "The event log service has stopped", refers to the system being shut down.
- Event 1074: can handle various shutdown options but usually it is when as users, or a program, it has caused the shutdown.
- Event 6005: "The event log service started.", indicates that the operating system has started.
- Event 1076 – Indicates the reason why the computer was shut down or restarted.
- Event 6013: "The system activity time is [hour]", it displays details of how long the equipment has been on, this value is given in seconds.
- Event 6008: "System shutdown prior to [time] on [date] was unexpected" refers to the computer booting after an unsuccessful shutdown.
- Event 6009: indicates issues associated with the processor to shut down the computer.
step 5
In the new window we are going to enter the desired IDs to see their results in the Event Viewer:
step 6
We save the changes:
step 7
By clicking OK we will only see these events in the console:
step 8
We can see specific details at the bottom such as:
- Date and time of the event
2 View Windows 11 power on and off log from console
Through the console of the command prompt or the Terminal we can have access to this information on the shutdown and startup events of Windows 11.
Step 1
First we open cmd as administrators:
7
Step 2
We accept system permissions:
Step 3
In the console we are going to execute the following command indicating the number of the event that we want to see:
wevtutil qe system "/q:*[System [(EventID=6006)]]" /rd:true /f:text /c:1
Step 4
We have used wevtutil which is a command line tool that allows us to administer and manage the event logs of the event viewer, by pressing Enter we see the details of said event in full.
If we need to search for several identifiers at the same time, we are going to right click on the Start menu and then click on “Terminal (Administrator)”:
step 5
We accept system permissions:
step 6
We execute the following command indicating the IDs to be displayed:
Get-EventLog -LogName System |? {$_.EventID -in (6005,6006,6008,6009,1074,1076)} | ft TimeGenerated,EventId,Message -AutoSize -wrap step 7
Pressing Enter we see each event summarized:
3 View Windows 11 power on and off log from application
Step 1
Finally we can make use of a free application which we can download at the following link:
TurnedOnTimesView
Step 2
The objective of this utility is to analyze the system event log to detect the time intervals when the equipment is turned on, based on this data, data such as:
Step 3
At the bottom we find the download link, we wait for the download to finish.
Step 4
In the Downloads folder we right click on the file and select the "Extract all" option:
step 5
We define where the file will be extracted:
step 6
We click on "Extract" to complete the process:
step 7
We run the file to access the application.
step 8
In this window we can see all the details of turning the PC on and off, we must validate the reason in the "Shutdown reason" column, there it will say if it was a turn on, restart or shutdown. Now we are going to go to the "Options" menu and there we click on "Advanced Options":
step 9
We will see some options to use:
step 10
It is possible to check a remote computer, access external drives and more:
These options are functional and useful to have access to the power on and power off events of the equipment.
