You should know, first of all, that it is only possible to consult the computer’s ignition and shutdown history when the operating system has been installed, and therefore if at any point you have formatted the computer, this history has been restarted and you will not be able to view the data before formatting. This is because the activation and deactivation history is recorded at the operating system level and is not reflected in any hardware component itself.
Check Windows activation and deactivation history
Windows Event Viewer is a great tool that records all kinds of events that happen on your PC. With each event, the viewer logs an entry, and it is handled by an event log service that cannot be manually stopped or disabled because it is a basic Windows service, so you can be sure that this tool moni tored all power ups. out of your PC.
Moreover, these events also record the start and stop history of the event log service itself, so you can take advantage of these hours to get a feel for when your PC was turned on and off.
Events for the Event Log Service are logged with two different codes. On the one hand, the ID 6005 indicates that the event log service has been started and therefore the operating system has started, while the ID 6006 indicates that the event log has been stopped and the system has therefore been stopped or restarted. Obviously if you see a 6006 event and after a short time a 6005 means the PC has been restarted or has been turned off and on immediately.
To access Windows Event Viewer, you can simply click the Start button and type “Event Viewer” or press WIN + R to bring up the Run window and type eventvwr.msc.
In the window that will open, you need to navigate in the left panel to Windows Registers -> System. You will see that in the central part there is a large amount of information that we now need to filter to select only the system events that interest us.
Now on the right side click on “Filter current record …” and in the section where it says
Click OK, and you will see how the middle column of Event Viewer now only shows those events with IDs 6005 and 6006. In the following screenshot, we can see that, for example, it There is an event 6006 at 11:50 pm at night which indicates when the PC was shut down. The day before, at 8:25 am, an event 6005 was recorded, which means that this is the time the PC was turned on.
As you can see there are in total over 20,000 such events recorded, so we could use the vertical scroll bar down to see previous events and in general all ignition history and shutting down the PC.
If you want to study the event log a little more, you can check event 6013 which will show you the availability of the PC, as well as event 6009 which shows the processor information detected during startup. Event ID 6008 will tell you that the system has started after it failed to shut down properly (that is, a system hang). You can also configure custom Event Viewer views to more easily view this information in the future. This will save you time and avoid having to remember these event IDs.
Show activation hours
TurnedOnTimesView is a simple, installation-free tool that allows you to analyze the event log to also know the PC’s on and off history. Note that yes, the last power-on event appears in orange instead of green or red, and that’s because this is the current session in which there is no event yet. power off saved.
As soon as you open the tool, you will see a window like the one we have shown above, listing the system start and stop times and calculating how long the equipment has been on, along with the reason. of the stop. (this is only available in Windows Server, yes, because in this operating system you have to justify why you are shutting down the system when you go to do it).
The utility can be used to see the list of shutdown and start times for your PC and any other you have on the local network, as long as you are running it with a user who has administrator rights on the Remote PC. To see the start and stop times of a remote PC, go to Options -> Advanced options and select “Remote computer” from the “Data source” drop-down list, then enter the IP address of the remote PC in ” Computer name “.
The truth is that even though Windows Event Viewer will give you all the information you need, a tool like this is very comfortable because it gives you all the information already condensed and even calculating the time that the PC has been turned on.
