PCLANVADWPB
asked on
Windows startup/shutdown date/time log
On most version of Windows I am able to go to the command prompt and type in SystemInfo, from there I can tell when the computer last booted.
We have a need to see the startup/shutdown log, going back a good 30 days. Is this info somewhere in the event viewer ? We are not interested in EVENT 6008 where is says the previous shutdown was unexpected. We want normal startup/shutdown log.
We have a need to see the startup/shutdown log, going back a good 30 days. Is this info somewhere in the event viewer ? We are not interested in EVENT 6008 where is says the previous shutdown was unexpected. We want normal startup/shutdown log.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
You may need to tune the logfile size of the system event log, I am not sure if it would show 30 days with default size settings. Yes, all info is in there, the event id is quickly found when you look at the startup time of today and then filter for it.
ASKER
Thanks Vince Glisson,
TurnedOnTimeView is exactly what I was looking for. I always like NIRSOFT he is excellent. I didn't know he made such a program.
TurnedOnTimeView is exactly what I was looking for. I always like NIRSOFT he is excellent. I didn't know he made such a program.
Your Welcome, there are still people out there that create wonderful tools...
That utility is not doing exactly what you'd like it to do on modern OS'. On windows 8/8.1 and 10, it will not function when fast startup is being used. The times it reveals are not the times you will expect to see. Fast startup means, the system uses a type of hibernation ("kernel hibernation") when you select shutdown and resumes from it when you turn the machine on. So it will payoff to look at the event log and use filtering in there.
ASKER
Good comment McKnife. I will keep that in mind. I assume fast startup is something people do more on laptops.
For our particular situation the owner of the business wanted to know which desktop computers got turned on and off on weekends. They were suspecting that the cleaning people were playing with their computers so pulling the log using Vince Glisson's link solved the problem in this case, because all desktop PCs get turned off Friday afternoon.
We password protect every PC but people still try.
For our particular situation the owner of the business wanted to know which desktop computers got turned on and off on weekends. They were suspecting that the cleaning people were playing with their computers so pulling the log using Vince Glisson's link solved the problem in this case, because all desktop PCs get turned off Friday afternoon.
We password protect every PC but people still try.
No, fast startup is the standard nowadays, on every machine with win8.x/10.
Password protecting PCs is no protective measure unless you encrypt them at the same time. Without encryption, every room cleaner script kiddie can break in in minutes. He can also harvest the data from that pc without even needing to start windows, so no logs will be populated.
Password protecting PCs is no protective measure unless you encrypt them at the same time. Without encryption, every room cleaner script kiddie can break in in minutes. He can also harvest the data from that pc without even needing to start windows, so no logs will be populated.