Home / server / Questions / 401961
Accepted
Param
Asked: 2012-06-26 02:17:52 +0800 CST

Event Log time when Computer Start up / boot up [duplicate]

  • 772

Client OS - Window XP

Domain Controller:- Window server 2008 Standard R2

I had one Windows XP system. I want to find out when the system has started or boot ( at what time and date ). I don't know which parameter / word should I search for in Event Log.

For finding out shutdown time, I simply find the word "Shutdown" in Event Log.

Can you guide me which word should I should search for to determine Start up or boot time?

windows windows-xp eventviewer

2 Answers

  1. Best Answer

    EventViewer ( System Log )

    6009 and 6005 same time stamp, system just started.

    6013 - system has been up for a day or more, time in seconds.

    6006 - the system was rebooted or shutdown.

    PowerShell: Get All Reboot Messages in the Last Month

    Get-EventLog -LogName System -After $(Get-Date).AddMonths(-1) | Where { 6009,6005,6006 -contains $_.EventID}
    • 13

  2. Look for the message saying the event log has started.

    Event 6005 Event Log Service has started

    Or Event 6009 with info about the OS build, service peck level, etc.

    • 1