How one can Use PowerShell to Gaze When Your PC Final Rebooted

How one can Use PowerShell to Gaze When Your PC Final Rebooted

There’s nothing fancy coming support to your Windows PC to search out that everything’s been refreshed. None of your apps are commence. Your net browser tabs are long previous, as is your browser itself. That document you were engaged on? Optimistically you autosaved, due to it appears fancy your system reset for whatever cause.

Whereas I will’t essentially repeat you the cause Windows restarted, it’s easy to search precisely when the reset occurred, and that will per chance maybe can support you pinpoint the matter per your bear info of what you’ve been doing. (Or, as a minimum, you’ll receive a correct view whether or now not something fancy a scheduled Windows Update is to blame, versus a random, middle-of-the-night smash.)

To receive started, fan the flames of PowerShell and kind on this clarify:

Procure-EventLog -LogName Machine |? {$_.EventID -in (6005,6006,6008,6009,1074,1076)} | toes TimeGenerated,EventId,Message -AutoSize -wrap

(If that doesn’t work, due to Kinja might per chance well maybe be fussy with characters, simply replica and paste it from this Quora acknowledge.)

Wait a bit while PowerShell chugs, and also you’la final receive a mask mask that appears fancy this:

Illustration for article titled How to Use PowerShell to See When Your PC Last Rebooted

Screenshot: David Murphy

G/O Media might per chance well maybe receive a rate

It shouldn’t receive a ton of sleuthing to settle on out when your system shut down and commenced up. In the above instance, you’ll appreciate EventID 6006 and 1074 going down at roughly the same time two days ago (March 22) at round 4: 00 p.m. I shut down my computer then (ensuing from this reality the occasion log carrier stopping and the ghastly “shutdown message” from EventID 1074). And I become my computer support on at 5: 20 that day, which is when Windows reported its product name at boot (EventID 6009) and the Event log carrier started up (EventID 6005).

Whereas you’re looking at the log, you potentially can moreover seek for “unplanned” or “unexpected” shutdowns, which might per chance well maybe give you yet another clue that your system crashed, had an impact outage, or had every other, inexplicable clarification for turning off.

undefined

Screenshot: David Murphy

You might per chance well maybe moreover strive attempting to search out these occasions without delay inside of Windows 10’s Event Viewer. Simply commence the Windows Logs folder and click on on Machine, then initiate scrolling (or filtering) for the aforementioned EventIDs. Whereas you’re at it, throw EventID “41″ into the mix, which is willing to can support you know if your system rebooted with out cleanly shutting down—one indicator that it potentially crashed, suffered an impact loss, or correct had a shutdown subject.

Updated 3/24/21: We before everything published a version of this tale in 2010; David Murphy updated it in 2021 (!) with fresh a sooner device to utilize PowerShell, in predicament of Event Viewer, to search out out when your system final rebooted. We moreover added fresh photos.

Read More

Share your love