How to Quickly Track Shutdown and Restart details

1. Go to Start > Click Run.
2. Type in Eventvwr.msc and hit enter.
3. Event Viewer console will open up.
4. Under the left Hierarchy tree > Select Windows logs > System
5. Once you select ‘System‘ , Right click it .
6. A menu will pop up, select ‘Filter Current Log‘ .
   
7. A new ‘filter current log‘ dialogue box will appear.
8. Under the highlighted box, type in Event Id’s 1074, 6008

   Event ID 1074 : USER32 events, are generated whenever a user Shutdown/Reboots the machine.
   Event ID 6008 : EventLog events, are generated henever machine crashes or abruptly Shutdown/Restart.

9. Click OK button, at bottom of the dialogue box.
10. You will observe that only event id 1074 and 6008 are selected, rest are filtered out.
    
11. You will see a description at the bottom of the window, with detailed information about this shutdown/restart event.
12. If you don’t remember the Event Id’s, no issues 😉 – You can directly filter the USER32 and EventLog events under the Event Sources drop down menu, in the ‘Filter current log‘ dialogue box.

~ For more detailed ways to track uptime of a machine follow this Link .

Happy Learning !