Shut Down - View Details of Last Shutdown of Computer

How to View Previous Shutdown and Restart Details in Windows​

   Information

This will show you how to view the date, time, and user details of all shutdown (power off) computer events in Event Viewer in Vista, Windows 7, and Windows 8.

You must be logged in as an administrator to be able to do this tutorial.

Here's How:
1. Press the Windows + R keys to open the Run dialog, type eventvwr.msc, and press Enter.

2. If prompted by UAC, then click/tap on Yes (Windows 7/8) or Continue (Vista).

3. In the left pane of Event Viewer, double click/tap on Windows Logs to expand it, click on System to select it, then right click on System, and click/tap on Filter Current Log. (see screenshot below)

4. Do either step 5 or 6 below for what shutdown events you would like to see.

5. To See the Dates and Times of All User Shut Downs of the Computer
A) Click/tap on the drop down arrow to the right of Event sources, check the USER32 box, and click/tap in the <All Event IDs> field. (see screenshots below)




B) In the <All Event IDs> field, type 1074, then click/tap on OK. (see screenshot below)

C) This will give you a list of power off (shutdown) and restart Shutdown Type of events at the top of the middle pane in Event Viewer.

D) You can scroll through these listed events to find the events with power off as the Shutdown Type. You will notice the date and time, and what user was responsible for shutting down the computer per power off event listed. (see screenshot below)
NOTE: The user is listed as Computer Name/User Name, such as Brink-PC\User-name for example.

E) Go to step 7.
6. To See the Dates and Times of All Unexpected Shut Downs of the Computer
A) In the <All Event IDs> field, type 6008, then click/tap on OK. (see screenshots below)




B) This will give you a list of unexpected shutdown events at the top of the middle pane in Event Viewer. You can scroll through these listed events to see the the date and time of each one. (see screenshot below)

7. When finished, you can close Event Viewer.
That's it,
Shawn

Related Tutorials

---

• How to See What Woke Up Your Computer Last
• How to Read the Wake Source Log in Event Viewer for Windows 7 and Vista
• How to See What the System "Up Time" is in Vista and Windows 7
• How to Allow or Prevent Users and Groups to Shut Down the Computer
• How to Change the Default Action of the Windows 7 Alt+F4 Shut Down Window
• How to Speed Up the Shut Down Time in Windows 7
• How to Create a Shut Down Windows Shortcut in Windows 7
• How to Create a Shut Down Computer Shortcut in Windows
• How to Create a Task that will Shut Down the PC Automatically
• How to Enable or Disable Shut Down without Having to Log On
• How to Change the "Shutting down..." Text Message at Shut Down in Windows 7 and Vista
• How to Add or Remove the Shut Down, Restart, Sleep, and Hibernate Commands in Windows 7
• How to See Windows 7 Reliability and Problem History with Reliability Monitor
• How to Review Your Windows 7 Reliability and Problems History
• Create Event Viewer Log Entries when Users Log in or Log off or Manipulate User Accounts in Windows 8
• How to View and Override Power Availability Requests in Windows
• How to Perform an Emergency Restart in Vista, Windows 7, and Windows 8
• How to Enable or Disable to Display Highly Detailed Status Messages in Windows 8 and 8.1

 

[jraju]

Hi, thanks brink
but curiously each shutdown have different sub ids inside this no problem shutdown . But i could not decipher. says 0x5kff and something with notable difference. what is to be made out of this logs.

 

[Brink]

I'm afraid that I don't know.

 

[jraju]

Hi, Brink,
That i could get up to this log. Would you now say what action i need to take up to stop this. Some windows services are also in the log. like Fd ..services etc.
Would sudden shutdown due to power surge, makes sudden adjustment of closure of files, leading to this?. I have experienced one or two time like this.
Hi, brink, i want to know, whether sudden unexpected shutdown, would cause, the next shutdown problems and continue till you either do sfc scan or chkdsk /r/f . Is this point correct?.
Does it mean, that if by chance, this kind of unkind power loss and shutdown happens, one should do chkdsk ( mandatory) to avoid future shutdown hangs
what is False and true denote in the enclosed log

 

[Brink]

From your log, the listed items caused a delay in shutting down.

You might see if the tutorials below may help with shutting down time.

http://www.sevenforums.com/tutorials/717-shut-down-speed-up.html

HungAppTimeout Threshold - Specify in Windows

WaitToKillAppTimeout - Specify for Shutdown in Windows

 

[jraju]

Hi, Brink,
I think that there is difference between delay in shutting down and not at all shutting. My case is the second.
If these logs are correct picture captured by windows log, then allowing some more time would have aauto shut those and then computer shut down

 

[Brink]

If you reduce the time, Windows will force them to close for a faster shut down.

 

[jraju]

Hi, Brink, Is there a way, that all the pending applications, background exe like avastui.exe, not showing in the taskbar applicatins, but running in the background, incd etc etc be automatically end normally without users going to taskbar to find and close,also non responsive programsetc,thereby not causing shutdown delays.
Windows force closure may not give adequate time to copy to hard drive from memory, before shutdown as usual.

 

[Brink]

You could try reducing the times in the tutorials I posted above to have Windows automatically force close them to hopefully prevent the delay.

 

[jraju]

Hi, Brink thank you for your replies. But forcing the applicaion closure would not have any effect on the process of shutting down, like creating problem in actual shutdown process of copying the memory to the hard disk before closing resulting in either not starting up properly with or shutdown?.
Pl see my post. I asked you whether abrupt shutdown would lead to the shutdown problems. Pl confirm.

 

[Brink]

Abrupt improper shutdowns (ex: holding down case power button to turn off power) could cause data corruption that could lead to all sorts of issues.

It's up to you if you wish to try what I posted above or not, but I do believe it could help. It's not going to hurt anything to try, and you can always easily undo it afterwards.

 

[we4r90ofd]

Hello Brink, thanks for this tutorial and the great support you are providing to the community !

I was seeking to get an extract of all the times my laptop went to sleep. It doesn't appear in the "unplanned" shutdown (which much more appears to be tracing issues-related shutdowns if I understood it right). Can you help me with this ?

Besides, as this would make 3 types of computer stop (normal shutdown by user, unplanned/crash shutdown, and time/delayed shutdown) are there any other types of shutdown ? Any source at Microsoft that would list those ?

All the best !
AlterMind

 

[we4r90ofd]

Hi All, I spent more time googling and browsing forums but without much accurate help. I however saw that some "Kernel" sources could be selected from the event viewer and went back to the tool.

When selecting Windows Logs > System > RightClick > Filter Current Logs... : Event sources : Kernel-Power I get exactly what I was looking for, including when the computer goes to sleep (after idle delay) and goes to hibernate (after sleep delay) !

My question wrt to all other kinds of shutdown still remains, of course

Cheers!

 

[Brink]

Hello AlterMind,

I'm glad you found what you were looking for.

Here's some more information about shutdown event tracker overview from Microsoft to help.

https://technet.microsoft.com/en-us/library/cc753185(v=ws.11).aspx

 

[we4r90ofd]

Hi Brink,

Thanks for this prompt response -- and the interesting link on MS TechNet!

I additionally discovered while further browsing the event viewer that the Event sources : Power-Troubleshooter would flag the wake-up after a sleep shutdown! This diverse and apparently poorly-consistent use of event sources tags is not help much in our endeavour... But as I learned a few things, I guess it's all nice and well, kind of

Take care.
@+++