While fixing BSOD errors, sometimes you’re asked to show the startup and shutdown history to pinpoint what’s causing the crashes. It’s kind of weird, but Windows has built-in ways to check these logs without installing anything extra—useful for quick troubleshooting or when you’re running in a pinch. This info can reveal if the computer unexpectedly shut down, crashed, or just kept restarting without warning, helping narrow down the culprit.
How to Track Startup & Shutdown History in Windows 11
Check with Event Viewer
Using the Windows Event Viewer is probably the easiest and most direct way to peek into your PC’s boot and shutdown records. It’s handy because you can see detailed logs tied to specific Event IDs. Just remember, this applies if you want to see exactly when your PC started or stopped, especially if something’s fishy going on. Expect to find entries for normal startups and shutdowns—and other error events if things weren’t smooth.
Open Event Viewer by searching in the Windows menu. Navigate to Windows Logs > System. Once there, find Filter Current Log.. from the right pane. This filters the logs so you only see the relevant events.
Then, type in the Event IDs: 6005 (which logs when Windows starts, aka the “Event Log service started”) and 6006 (which shows when Windows shut down properly).Hit Ok. Now, you’ll see a list of entries with timestamps—your startup & shutdown history—appearing in order.
Here’s a quick side note: sometimes Windows logs other events, like 41 or 1074, which tell you if the shutdown was unexpected or triggered manually. These are super useful if crashes happen around shutdowns or restarts.
Check with Command Prompt
If you prefer a command-line approach, or if Event Viewer is being stubborn, PowerShell or Command Prompt works too. It’s kinda neat because you can directly query the logs without opening a GUI. Plus, on some setups, this method is quicker once you get the hang of it.
Open Command Prompt as admin—search it, right-click, select Run as administrator. To see the latest startup event, run this:
wevtutil qe system "/q:*[System [(EventID=6005)]]" /rd:true /f:text /c:1 | findstr /i "date"For shutdown history:
wevtutil qe system "/q:*[System [(EventID=6006)]]" /rd:true /f:text /c:1 | findstr /i "date"This pulls up the most recent startup or shutdown event with the timestamp. If that seems too basic or not enough info, you can bump up the /c to get more logs, or just keep running the commands in a loop to see everything. Not sure why it works, but on one setup this fails the first time, then works after a reboot.
Be aware, there are third-party tools out there claiming to track this stuff, but honestly, they usually just scrape Event Viewer logs anyway—no need to install extra junk. Plus, that means your data stays local.
Hopefully, this helps make sense of your startup and shutdown history — kind of weird how Windows hides this from the casual user.