How to Use PowerShell to Find Out When Your Computer Last Restarted
There is nothing better than going back to your Windows PC and finding that everything has been updated. None of your apps are open. Your web browser tabs are gone, as is the browser itself. The document you were working on? Hopefully you saved automatically because it looks like your system has rebooted for some reason.
While I can’t tell you exactly why Windows restarted, it’s easy to see exactly when the reset occurred, and it can help you pinpoint the problem based on your own knowledge of what you were doing. (Or at least you will have a good idea of whether something like a scheduled Windows update or an accidental crash in the middle of the night is to blame.)
First, start PowerShell and enter this command:
Get-EventLog -LogName System |? {$_.EventID -in (6005,6006,6008,6009,1074,1076)} | ft TimeGenerated,EventId,Message -AutoSize -wrap
(If that doesn’t work because Kinja can be picky with characters, just copy and paste it from this Quora answer .)
Wait a little while PowerShell chugs and you end up with the following screen:
It doesn’t take much effort to figure out when your system shuts down and starts up. In the example above, you will see that events ID 6006 and 1074 happened at about the same time two days ago (March 22) at about 4:00 PM. I shut down my computer (hence the stoppage of the event log service and the obvious “shutdown”). message “from EventID 1074). And I turned my computer back on at 5:20 a.m. the day Windows reported its product name at boot (EventID 6009) and the event log service started (EventID 6005).
Looking at the log, you may also look for “unplanned” or “unexpected” outages, which could give you another clue that your system crashed, lost power, or had some other unexplained reason for the shutdown.
You can also try looking for these events directly in Windows 10 Event Viewer. Just open the Windows Logs folder and click System, then start scrolling (or filtering) the above Event IDs. While you are doing this, add EventID “41” to the mix, which will tell you if your system rebooted without completely shutting down – this is one indicator that it is potentially crashing, there is a power loss, or just a shutdown problem.
Updated 03.24.21: We originally published the 2010 version of this story; David Murphy updated it in 2021 (!) With a new, faster way to use PowerShell instead of Event Viewer to find out when your system was last rebooted. We’ve also added new images.