Open Nav

How to Check Shutdown History in Windows 11 using GUI or Command line

If you’ve ever needed to know when your Windows 11 computer was last shut down, restarted, or powered back on, you’re not alone. System administrators, power users, and even everyday users might want to check the shutdown history for a variety of reasons—from diagnosing issues to simply satisfying curiosity. Fortunately, Windows 11 offers several ways to view this history using both the graphical user interface (GUI) and command-line tools. Let’s explore these methods, making it easy for anyone to track their PC’s power events.

TL;DR (Too Long; Didn’t Read)

To check shutdown history in Windows 11, you can use either built-in GUI tools like Event Viewer or opt for command-line utilities such as Command Prompt or PowerShell. Event ID 1074 and 6006 are useful identifiers when browsing logs. These methods help diagnose shutdown-related issues or confirm when a system was last turned off or restarted. If you’re looking for a quick overview or an in-depth timeline, there’s a method to fit your needs.

Why You Might Want to Check Shutdown History

Understanding when and why your PC shut down can help in various scenarios:

  • Troubleshooting Crashes – Figure out if your system shut down unexpectedly or due to a power loss.
  • System Monitoring – Keep track of usage for maintenance or auditing purposes.
  • User Accountability – See if multiple users are following proper shutdown procedures.

Checking Shutdown History via the GUI

The Event Viewer in Windows 11 is the most comprehensive graphical tool to view all system events, including shutdowns and restarts.

Using Event Viewer

Follow these steps to use the Event Viewer:

  1. Press Windows + S and type Event Viewer. Click on the app to open it.
  2. In the left panel, navigate to Windows Logs > System.
  3. In the right panel, click Filter Current Log.
  4. In the Event IDs box, type 1074, 6006, 6008 and click OK.

Here’s what these Event IDs mean:

  • 1074 – Provides the reason for shutdown (manual, automatic install, etc.).
  • 6006 – Indicates that the Event Log service was stopped during a proper shutdown.
  • 6008 – Indicates an unexpected shutdown.

Clicking on each event in the middle pane will give you detailed information about the time and cause of the shutdown.

Event Viewer Tips

  • Use the Create Custom View option to make it easier next time.
  • Export your logs if you plan to analyze them later or share with support personnel.

Using the Command Line

If you prefer a quicker and more automated approach, the Command Prompt and PowerShell are excellent choices for checking shutdown history.

Method 1: Using Command Prompt

You can use the wevtutil command or query commands to dive into shutdown data.

To list recent shutdown events, do the following:

  1. Press Windows + R, type cmd and press Enter.
  2. Enter the following command:
wevtutil qe System /q:"*[System[(EventID=1074)]]" /f:text /c:10

This command queries the 10 most recent entries for Event ID 1074, showing text output. You can modify the number by changing the value of /c.

Method 2: Using PowerShell

PowerShell offers more scripting flexibility and output formatting.

Try this command to get the last 10 shutdown events:

Get-WinEvent -FilterHashtable @{LogName='System'; ID=1074} -MaxEvents 10 | Format-List

You can adjust the -MaxEvents value to show more or fewer records. To include other shutdown-related events like unexpected shutdowns, modify the ID array like so:

Get-WinEvent -FilterHashtable @{LogName='System'; ID=@(1074,6006,6008)} -MaxEvents 20 | Format-Table TimeCreated, ID, Message -AutoSize
Understanding PowerShell's Cross-Platform Capabilities

Advantages of Using Command Line

  • Faster – Especially useful for repeated lookups or automation.
  • Filterable – Use scripts to extract exactly what you need.
  • Scriptable – Perfect for system administrators managing multiple machines.

Understanding the Output

Once you retrieve shutdown data, here’s how to interpret what you see:

  • TimeCreated – The exact timestamp of the shutdown or restart.
  • Message – This will often tell you if it was initiated by a user or a program, and sometimes even why.
  • EventID – Cross-reference IDs to know if it was a normal or unexpected event.

Frequently Asked Questions

Can I use Task Scheduler to track shutdowns?

Yes, you can set up a scheduled task triggered by specific Event IDs so you don’t have to manually check logs every time.

Do third-party tools offer better logging?

Some third-party system monitoring tools offer streamlined shutdown history, graphical representations, and real-time alerts. However, for most users, built-in tools are sufficient.

Does Fast Startup affect shutdown logs?

Fast Startup may skip parts of the shutdown process, potentially affecting when shutdown events are logged. You may want to temporarily disable Fast Startup if you’re troubleshooting shutdown events.

Best Practices for Monitoring

If you’re regularly monitoring shutdown history on a personal or work computer, consider the following tips:

  • Automate Reporting – Use PowerShell scripts to generate daily logs.
  • Keep Logs Clean – Delete old logs periodically to save disk space.
  • Tag Events – Add notes in Event Viewer using the “Comment” feature for future tracking.

Conclusion

Windows 11 offers comprehensive tools for investigating when and why a PC was shut down, restarted, or improperly powered off. Whether you’re a casual user or IT professional, knowing how to use both GUI and command-line options allows you to tailor your approach to fit the situation. The Event Viewer gives a user-friendly overview, while Command Prompt and PowerShell offer deeper control and automation capabilities. By mastering these tools, you’ll not only troubleshoot better but also maintain clearer oversight of system activity.

So the next time you’re left wondering whether your PC shut down properly—or why it didn’t—now you know exactly where to look.

Published on January 1, 2026 under .

Emily Harris