How to Check Windows Startup and Shutdown Times in Event Viewer

Use Event Viewer to check when Windows started and began shutting down. Create a custom view for the System log and filter for event IDs 12, 13, 6005, 6006, 6008, and 1074. Windows records these events automatically, so there is no need to install a separate logger. The entries describe operating-system and event-service activity; they do not always mark the exact moment someone pressed the power button.

Which Windows events show startup and shutdown?

Filter the Windows Logs > System log, then check each event's source as well as its ID. Microsoft cautions that an event ID can be used by different sources, so an ID alone is not enough to identify an event.

For a clean reboot, events 1074 and 13 can help show the request and shutdown sequence. Events 41 from Kernel-Power and 6008 can point to a shutdown that did not complete normally, such as after a crash or power loss. These records help establish a timeline, but they are not a complete diagnostic by themselves.

Create a custom view for startup and shutdown records

Event Viewer keeps the System log in a single list with many unrelated entries. A custom view saves a filter so you can return to the relevant events without repeating the setup.

1. Open Start, type Event Viewer, and press Enter. In the left pane, expand Windows Logs and select System.

2. Right-click Custom Views and choose Create Custom View. You can also use the Create Custom View command in Event Viewer when it is available in the Actions pane.
3. In the Logged menu, select Any time to include all retained events, or choose a shorter period or custom range. Under By log, select Windows Logs and then System.

4. In the event ID field, enter 12,13,6005,6006,6008,1074. Leave the event-level boxes unselected to avoid narrowing the filter by severity. Keep the User setting at its default to include all users unless your report needs a particular account. Select OK.

5. Give the view a clear name, such as Startup and shutdown, and optionally add a description. Select OK again. The saved view appears under Custom Views.

Read the timestamps and investigate missing entries

Select the saved view and review the Date and Time, Source, and Event ID columns. Sort by time to build a sequence. Double-click an entry to open its properties and read the full message; for example, a Kernel-General event 12 describes the operating system starting. Compare the source and message with the event ID instead of assuming every result with a matching number means the same thing.

If you see event 6008 or 41, look at nearby entries such as 1074, 13, and 1001 for more context about the next startup or a possible crash. A missing 6006 does not prove that Windows was never shut down; an interrupted shutdown, restart method, or overwritten System log can change what remains available. Windows retains events only until the log reaches its configured size and retention behavior, so older records may no longer be present.

Export the event records to CSV or XML

With the custom view selected, choose Save All Events in Custom View As in the Actions pane (or the corresponding command from the view's context menu). Choose CSV for a spreadsheet, XML for structured event data, or EVTX when you want to preserve a native event-log file for later review. Save the file with a descriptive name, such as startup-shutdown.csv.

There is a similarly named Export Custom View command. It saves the filter definition as an XML file so the view can be imported elsewhere; it does not export the matching event records. To export the records, use Save All Events in Custom View As. In Excel or another spreadsheet, confirm the date and time column imports as dates before sorting or calculating intervals.

Microsoft references

• Microsoft Learn: Troubleshoot unexpected reboots using system event logs
• Microsoft Learn: Get-WinEvent