How To Determine System Startups from Event Log

When shutting down and starting, Microsoft Windows logs events in the Event Log.

Although there are a variety of events which signify startup and shutdown, the simplest to check for startups is to filter by Event Id 6009 in the System log.

Event Id 6008 is logged when the previous shutdown was unexected (“dirty shutdown”).

See also:

• Why Windows NT Reports 6005, 6006, 6008, and 6009 Event Log Entries

• Security Event Descriptions (NT 3.5x/4)

• Logon Types

• http://www.nirsoft.net/utils/computer_turned_on_times.html