找出上次正确关闭或启动 PC 的时间是解决许多Windows问题的方法。另一种情况是公共系统。借助事件查看器^{(Event Viewer)}，管理员可以查看和监控未经授权使用计算机的情况。

无论是什么原因，您都可以直接从Windows^(Windows)了解上次打开和关闭 PC 的时间。您不需要为此使用第三方应用程序；Windows 事件查看器^{(Windows Event Viewer)}可以完美地处理它。

什么是 Windows 事件查看器？

Windows 事件查看器^{(Windows Event Viewer)}是一个Microsoft 管理控制台^{(Microsoft Management Console)}( MCC ) – 一项无法停止或禁用的Windows核心服务。它会跟踪您 PC 上发生的每一项活动。

在每个事件期间，事件查看器^{(Event Viewer)}都会记录条目。它还记录事件日志服务^{(event log service)}( Windows ) 的启动和停止时间，提供每个关闭过程的正确日期、时间和用户详细信息。

如何使用事件查看器？

除了记录Windows何时启动和停止之外，您还可以使用事件查看器^{(Event Viewer)}进行以下操作：

1. ^(Create)通过保存有用的事件过滤器来创建自定义视图。
2. 您可以查看来自不同事件日志的事件。
3. 您还可以创建和管理不同的事件订阅。
4. 创建^(Create)并安排任务在由另一个事件触发时运行。

Windows中与关闭和重新启动相关的事件类型

它们是与关闭和重新启动Windows 10操作系统相关的四个以上事件；我们将列出重要的五个。他们是：

• 事件 ID 41^{(Event ID 41)}：此事件表示Windows在没有完全关闭的情况下重新启动。
• 事件 ID 1074^{(Event ID 1074)}：当应用程序负责系统关闭或重新启动时，会记录此事件。它还指示用户何时使用“开始^(Start)”菜单或按CTRL+ALT+DEL重新启动或关闭系统。
• 事件 ID 6006^{(Event ID 6006)}：此事件表明Windows已充分关闭。
• 事件 ID 6008^{(Event ID 6008)}：此事件^(Event)表示不正确或脏关机。它会在最近一次意外关闭时显示。

如何在Windows 11/10

它们是找出上面列出的任何事件的不同方法。传统方式是通过事件查看器^{(Event Viewer)}应用程序本身。大多数事件都可以通过命令提示符^{(Command Prompt)}访问，如下所示。

1]从事件查看器^{(Event Viewer)}查看^(View)关机和重启事件

打开Run对话框，输入eventvwr.msc然后点击Ok。在事件查看器中，从左侧窗格中选择Windows 日志^{(Windows Logs)}>系统。^(System)从右侧，单击过滤当前日志^{(Filter Current Log)}链接。

在Hit Ok下方的框中输入41,1074,6006,6008。然后 Windows 会显示所有与关机相关的事件。Includes/Exclude Event IDs...

事件查看器^{(Event Viewer)}显示在系统上执行的每项操作的详细信息。在本文^{(this article)}中了解如何查看完整的事件查看器日志。

2]使用命令提示符^{(Command Prompt)}查看^(See)上次关机时间

打开命令提示符^{(Command Prompt)}，将以下代码复制并粘贴到窗口中，然后按 Enter^(Enter)：

wevtutil qe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1

要查看上次关机的时间戳^(timestamp)而不查看其他详细信息，请复制并粘贴下面的代码，然后按 Enter：^(Enter:)

wevtutil qe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1 | findstr /i "date"

尽管这种方法可以完成工作，但我们经常建议您使用方法一，即事件查看器^{(Event Viewer)}。它不仅更简单，而且也不涉及复制和粘贴命令。

我们希望你觉得这篇文章有用。

相关阅读^{(Related read)}：如何找出 Windows 停机时间、正常运行时间和上次关机时间^{(How to find out Windows Downtime, Uptime and Last Shutdown Time)}。

How to check the Shutdown and Startup Log in Windows 11/10

Finding oυt the last time the PC was correctly turned off or booted up is the way to start for troublеshooting many Windowѕ issues. Another scenario is a public system. Thanks to the Event Viewеr, administrators can view аnd monitor υnauthorіzed use of the comрuter.

Whatever reason it is, you can find out when last your PC was put on and shut down directly from Windows. You don’t need a third-party app for this; the Windows Event Viewer can handle it perfectly.

What is the Windows Event Viewer?

The Windows Event Viewer is a Microsoft Management Console (MCC) – a core service of Windows that cannot be stopped or disabled. It keeps track of every activity that takes place on your PC.

During every event, the Event Viewer logs entries. It also logs the start and stop times of the event log service (Windows), giving correct date, time, and user details of every shutdown process.

How to use the Event Viewer?

Aside from keeping a log of when your Windows start and stop, you can use the Event Viewer for the following:

1. Create custom views by saving useful events filters.
2. You can see events from different event logs.
3. You can also create and manage different event subscriptions.
4. Create and schedule a task to run when triggered by another event.

Types of events in Windows related to shutting down and restarting

They are more than four events related to shutting down and restarting the Windows 10 operating system; we will list the important five. They are:

• Event ID 41: This event indicates that Windows rebooted without a complete shutdown.
• Event ID 1074: This event is written down when an application is responsible for the system shut down or restart. It also indicates when a user restarted or shut down the system by using the Start menu or by pressing CTRL+ALT+DEL.
• Event ID 6006: This event indicates that Windows was adequately turned off.
• Event ID 6008: This Event indicates an improper or dirty shutdown. It shows up when the most recent shutdown was unexpected.

How to find the shutdown log in Windows 11/10

They are different ways to find out any of the events listed above. The traditional way is through the Event Viewer app itself. Most events can be accessed with the Command Prompt, as you will see below.

1] View shutdown and restart events from Event Viewer

Open the Run dialogue box, and input eventvwr.msc then hit Ok. In Event Viewer, select Windows Logs > System from the left pane. From the right, click on the Filter Current Log link.

Type in 41,1074,6006,6008 into the box below Includes/Exclude Event IDs... Hit Ok. Windows then displays all shutdown-related events.

The Event Viewer shows detailed information on every operation carried out on the system. Learn how to view full event viewer logs in this article.

2] See the last shutdown time using Command Prompt

Open the Command Prompt, copy and paste the following code in the window, and hit Enter:

wevtutil qe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1

To view the timestamp of the last shutdown without other details, copy and paste the code below then hit Enter:

wevtutil qe system "/q:*[System [(EventID=1074)]]" /rd:true /f:text /c:1 | findstr /i "date"

As much as this method gets the job done, we often suggest you use method one, which is the Event Viewer. Not only is it more straightforward, but it also doesn’t involve copying and pasting commands.

We hope you find this post useful.

Related read: How to find out Windows Downtime, Uptime and Last Shutdown Time.

Related posts

• 如何启用或Windows 11/10 Disable Boot Log

• 在哪里找到以及如何在Windows 11/10中读取Windows Update log

• Windows 10中缺少的日志

• Windows 10缺少Event Viewer

• Windows 10 BSOD log file location在哪里？

• 如何在Windows 10中清除Event Viewer中的所有Event Logs

• 自动Startup Repair无法在Windows 10修理您的电脑

• Monitor Windows Event Log Files使用SnakeTail tail实用程序

• 免费Startup Manager software Windows 10

• 什么是Fast Startup以及如何在Windows 10中启用或禁用它

• 如何使PWAs运行在Startup自动Windows 10

• 如何启用Print Logging在Event Viewer上Windows 10

• 启用Network Connections而在Modern Standby上Windows 10

• 如何使用Windows 10的Charmap and Eudcedit内置工具

• 视窗10同步设置不工作灰色

• 如何在Windows 10执行Automatic Startup Repair

• 什么是选择性Startup mode在Windows 10中

• 如何强制Windows 10完全关机以重新初始化它

• 如何详细介绍Windows 10的Event Logs与Full Event Log View

• Best免费Timetable software为Windows 11/10