You should know, first of all, that it is only possible to consult the history of turning on and off of the computer starting with the moment in which the operating system was installed, and therefore if at any time you formatted the computer, that history was restarted and you will not be able to consult data prior to formatting. This is so because the history of turning on and off is saved at the operating system level and is not reflected in any hardware component itself.
Check the history of turning on and off in Windows
The Windows event viewer is a wonderful tool that saves all kinds of events that happen on your PC. During each event, the viewer registers an input, and is handled by an event log service that cannot be stopped or disabled manually because it is a basic Windows service, so you can be sure that this tool has monitored all power-ups. and off your PC.
In addition, these events also record the start and shutdown history of the event log service itself, so you can take advantage of these times to get an idea of when your PC was turned on and off.
Events in the event log service are logged with two different codes. On the one hand, the ID 6005 indicates that the event log service was started and therefore that the operating system started, while the ID 6006 indicates that the event log was stopped and therefore the system was shut down or it rebooted. Obviously if you see an event 6006 and after a short time a 6005 means that either the PC was rebooted or that it was turned off and on again immediately.
To access the Windows event viewer you can simply click on the Start button and type “Event Viewer” or press WIN + R to bring up the Run window and type eventvwr.msc.
In the window that will open, you must navigate in the left panel to Windows Registries -> System. You will see that a large amount of information appears in the central part that we must now filter to select only the system events that we are interested in seeing.
Now, on the right side, click on “Filter current record …” and in the section where it says
Click OK, and you will see how the middle column of the Event Viewer now only shows these events with ID 6005 and 6006. In the following screenshot we can see that, for example, there is an event 6006 at 23:50 at night which indicates the moment when the PC was turned off. The morning before, at 8:25 a.m. an event 6005 was logged which means that it is the time the PC was turned on.
As you can see, there are in total more than 20,000 events of this type registered, so we could use the vertical scroll bar down to see previous events and, in general, the entire history of turning on and off the PC.
If you want to investigate the event log a little more, you can check event 6013 that will show you the PC uptime, as well as event 6009 that indicates the processor information detected during startup time. Event ID 6008 will let you know that the system started after it failed to shut down properly (that is, a “hang” of the system). You can also configure custom views of the event viewer to more easily view this information in the future. This will save you time and avoid having to remember these event IDs.
TurnedOnTimesView
TurnedOnTimesView is a simple tool that does not require installation that allows you to analyze the event log to also know the history of turning on and off the PC. Note that the last power-on event appears in orange instead of green or red, and this is so because it is the current session in which there is not yet registered a power-off event.
As soon as you open the tool, you will see a window like the one we have shown above, listing the startup and shutdown times of the system and calculating the duration of time that the equipment has been on, as well as the reason for the shutdown (this is only available in Windows Server, yes, since in this operating system you have to justify why you are turning off the system when you are going to do it).
The utility can be used to view the list of shutdown and startup times for both your PC and any other you have on the local network, as long as you run it with a user who has administrator permissions on the remote PC. To see the startup and shutdown times of a remote PC, go to Options -> Advanced Options and select “Remote Computer” in the “Data Source” drop-down, and then enter the IP of the remote PC in “Computer Name”.
The truth is that although the Windows Event Viewer will give you all the information you need, a tool like this is very comfortable since it gives you all the information already condensed and even calculating the time that the PC has been on .
