How to know when was Windows started or shutdown?

I need to develop a program in C# find out when was Windows started or shutdown.

Is there a log file that I can read to know Windows start and shutdown times? Or do you have any ideas how to do so?

EDIT :

With the help of Mr. Reed Copsey, the best answer is found under this question.

8 Answers 8

You can use the classes in System.Diagnostics.Eventing.Reader to access the system Event Logs.

According to this article you can use WMI to get the last boot date/time.

As Reed pointed out you could access the Event Logs and see when they were created. AFAIK there are no specific event entries for system startup/shutdown, but you could look for services that are usually started/stopped with Windows. Though using this approach means it won’t be 100% accurate, say if it crashes or it’s manually started/stopped/restarted. One event I consider is the most accurate is EventLog service start/stop event.

Edit

Turns out there was a shutdown event. You can replace the Linq to get it:

You could use the «System Up Time» performance counter to get the start time of the system:

Hope, this helps.

Last Restart time can be found using this piece of code

System.Environment.TickCount has a 24.8 days limitation.
This is because TickCount is a millisecond value contained in a signed 32 bits value.

Windows API exposes these two functions:
GetTickCount — returns a 32 bits value — available from Windows 2000
GetTickCount64 — returns a 64 bits value — available from Vista/Windows Server 2008

You can use GetTickCount64 this way:

Some more options:

In .NET 5 and .NET Core 3 , you can use the Environment.TickCount64 property.

Not the answer you’re looking for? Browse other questions tagged c# windows or ask your own question.

Linked

Related

Hot Network Questions

Subscribe to RSS

To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

site design / logo © 2021 Stack Exchange Inc; user contributions licensed under cc by-sa. rev 2021.4.16.39093

By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

How can I find out when Windows was last restarted?

How can I know when my computer running Windows 7 was last restarted?

I prefer a solution that doesn’t involve searching the event log, but something like wmic or maybe cmd commands.

15 Answers 15

systeminfo command is almost right what you need. On English Windows 7 you can also do:

Or with the help of WMIC:

The main difference between Windows 7 and Windows XP that in Windows 7 Microsoft can show only last boot up time.

Also in Task Manager:

One other way to do this is to use the following command-line that works both in Windows XP and Windows 7:

It has the advantage of being faster than the systeminfo alternative while formatting the date (which wmic does not). You also get a few other informations that can be useful if you are actually using this command for debugging a computer (since you are asking specifically for cmd , I’m assuming you are not doing this programatically).

You can find more informations on the net statistics command here: http://technet.microsoft.com/en-us/library/bb490714.aspx

Here is an example of the result (using a French copy of Windows 7 Pro SP1 x64, user-language doesn’t matter much for the command-line):

(the computer name is purposely blurred)

More details on http://en.wikipedia.org/wiki/Uptime about the accuracy when determining system uptime.

Important note: this method determines when the computer was last booted, not its uptime. The 2 numbers will be different if you use sleep/hibernate.

There’s the LastBootUpTime property of the Win32_OperatingSystem class. You can use WMIC with this command:

Or if you use Powershell, you can convert the time to something more readable than that annoying WMI datetime format:

Note that in later versions of PowerShell, you can also use Get-CimInstance, which will automatically return the value as a datetime:

The only irritating thing is that Get-CimInstance will sometimes change the name of some system fields from WMI objects, such as __SERVER here. You’d have to use either CSName or PSComputerName , which seems to work for me.

For Windows 10 users out there.

_{Please note that as pointed out by Alex the /sleepstudy command wasn’t added until Windows 8.1. /systempowerreport might work instead.}

Note that some of these other answers never worked for me, like searching the event-log for example was always missing some entries. @Florisz’s answer is also correct in that regard. Here is my solution:

In an administrator cmd shell, run the following command:

Then open the file sleepstudy.html in a browser. You will be greeted with amazingly organized statistics about shutdown/reboot/standby/hibernation from the last three days. (so, run periodically if you need)

An example of an output: (AFAIR, Showdown (Hybrid) means fast startup)

On just about any version of windows you can check the timestamp on the swap file.

dir /a:h c:\pagefile.sys

To get it in PowerShell:

Here’s the result:

On Windows 7 I prefer

WMIC doesn’t take into account sleep time, and I leave my workstation locked up at work sleeping during the week, ready to wake up the next day.

yet another way in a batch file to get boot time with wmic but in human readable form :

BOOTTIME : 2017-03-08 07:37

From a similar ServerFault question, search/filter the Windows System Event Log for Event ID 6009 .

On Windows 10: Event Viewer > Windows Logs > System and then the Filter Current Log. Action.

You can use PowerShell for this.

Shutdown

This will give you a list of logged shutdown times.

Alternative command, better optimized for remote connections:

Startup

The following command will give you a list of logged startup times.

Alternative command, better optimized for remote connections:

I have tested this on PowerShell 5.1 and Windows 10.0.15063. But it should work on Windows 7 as well, as long as you have at least PowerShell 3.0. Note that you need to run it as admin.

You will find the full documentation for the command here: docs.microsoft.com

A couple of answers mentions net statistics workstation and I’ve noted that both :

should provide data regarding last boot on the Statistics since . line.

However, some OS versions (like Svr2008/6.0) will return 1/1/1980 12:00 for the date when using server . So I’ll default to workstation .

Also you can abbreviate some of the command like net stats workstation and get the same results. Finally, if you jump around from system to system, the default CMD box isn’t large enough to show all results from the command. So I’ll pipe the output to more to avoid scrolling up to see the boot time. Therefore, my default command is:

I want to add, that all these commands really give you the timestamps when a ‘restart’ or ‘reboot’ is done. And not when a shutdown and start is done. After shutdown and start the ‘lastbootuptime’ will reflect the time the system is really ‘restarted’ and not the actual boot up time. So shutdown/start gives the same result as coming back from suspend/hybernnate for the LastBootUpTime timestamp.

Same as Max answer .

. but in oneliner:

This wmi implementation may appear a little messy but it’s very fast compared to other powershell or systeminfo implementations and you can easily change the format since it’s explicit in the code.

Note most of these answers will give the last «restart» time as requested by the OP. But some of you who shutdown your computer rather than restart it will notice that the time doesn’t match your boot time.

To get the true last start time, open a PowerShell command prompt (doesn’t need to be run as an administrator):

Get-WinEvent -ProviderName Microsoft-Windows-Kernel-boot -MaxEvents 10 | Where-Object

Which will return:

In the Message field you’ll see one of these boot types:

Counterintuitively, after a restart the boot type will be 0x0 but after a shutdown (with Fast Start) the boot type will be 0x1 .

You can isolate the time value with:

Get-WinEvent -ProviderName Microsoft-Windows-Kernel-boot -MaxEvents 10 | Where-Object <$_.id -eq "27">| select -ExpandProperty TimeCreated

The reason systeminfo | find «Boot Time» and other similar solutions give the last restart time rather than the time you booted Windows after a shutdown has to do with «Fast Startup» which is on by default (read more here: https://www.howtogeek.com/349114/shutting-down-doesnt-fully-shut-down-windows-10-but-restarting-it-does/).

I’ve always considered an explicit shut down to be a more thorough way of restarting a computer but in fact that seems to be incorrect under Windows 10 with Fast Startup enabled. However, you can force a «hard» shutdown even with Fast Startup enabled by holding down the shift key while clicking «Shut Down» from the start menu.

Lifecycle FAQ — Windows

Originally published: July 26, 2016
Updated: April 6, 2021

Please go here to search for your product’s lifecycle.

Windows — General

What is the Lifecycle Policy for Windows?

Windows 10 Semi-Annual Channel and Windows Server Semi-Annual Channel are governed by the Modern Policy. Other Windows products are governed by the Fixed Lifecycle Policy. Search for the product lifecycle for your specific Windows product and its corresponding Lifecycle Policy and end-of-support dates.

What is the difference between a Windows quality update and a Windows feature update?

A Windows quality update is an incremental update to Windows products that includes bug fixes and security issue resolutions but includes no new features.

A Windows feature update is an update that contains new features. A feature update also includes all previous quality updates, as applicable.

Go here for more information on these terms.

If I obtained Windows when I purchased a new device, who provides support?

If you have a valid Windows license, you are eligible for support from Microsoft, subject to the Microsoft Lifecycle Policy and the support terms and conditions that were in place at the time of purchase. If you acquired your Windows operating system through the Microsoft Volume Licensing program or from an Original Equipment Manufacturer (OEM), Microsoft offers access to a wealth of online self-help support content in addition to paid technical help offerings. If you acquired your Windows operating system through an OEM, you may also contact your OEM for more information about the support offerings for Windows operating systems from that OEM.

Can I use prior versions of Windows on a device running a newer version?

To use prior versions of Windows on devices currently running a newer version, it is possible for customers to obtain a license for downgrade rights. These downgrade rights will vary depending on whether the software was acquired via Volume Licensing, Original Equipment Manufacturer (OEM), or Full Packaged Product (FPP). To learn more about these rights, review the downgrade rights licensing brief. Prior versions of Windows, including Windows 8.1, have limited support when running on new processors and chipsets from manufacturers like Intel, AMD, NVidia, and Qualcomm. For more information, please see Microsoft Lifecycle Policy. A device may not be able to run prior versions of Windows if the device hardware is incompatible, lacks current drivers, or is otherwise outside of the original equipment manufacturer’s (OEM) support period.

When a Windows operating system (OS) reaches the end of its lifecycle or is no longer supported, does that mean new programs will not run on that OS?

Once a Microsoft operating system (OS) reaches the end of support, customers will no longer receive security updates. The OS may still work with programs and hardware after the sale or support of the operating system has been discontinued. However, the possibility increases that new programs and hardware will not be performant on an older OS. This frequently occurs because the manufacturers of new hardware and software make product-design decisions that take advantage of the increased functionality and features in newer operating systems. These manufacturers may decide to discontinue support of their products on older operating systems as appropriate.

Windows 10

What is the servicing timeline for a version (feature update) of Windows 10?

New versions of Windows 10 (also called feature updates) will be released twice a year for Windows 10 via the Semi-Annual Channel. Customers should always install the latest version before the current version reaches end of servicing to remain supported by Microsoft.

As of September 6, 2018, we have evolved our servicing timeline for customers who need more time to test and deploy Windows 10 feature updates. Supported versions will be serviced via monthly quality updates.

Edition

Servicing timeline
Released first half of year (H1)

Servicing timeline
Released second half of year (H2)

Windows 10 Enterprise
Windows 10 Education
Windows 10 IoT Enterprise

18 months from release date

30 months from release date

Windows 10 Pro
Windows 10 Pro Education
Windows 10 Pro for Workstations
Windows 10 Home 1

18 months from release date

1 Home edition does not support the deferral of feature updates and will therefore typically receive a new version of Windows 10 prior to the end-of-servicing date shown.

What are the requirements for servicing and updating Windows 10 Semi-Annual Channels?

To receive monthly quality updates, customers must be on a supported version of Windows 10. Go here for support dates.

Windows 10 quality updates are cumulative, with each update built upon the quality updates preceding it.

What are my installation options for Windows updates?

It is highly recommended that customers install the latest feature update to stay up to date with the latest security updates, as well as to continue receiving future feature updates, with less impact on IT processes and infrastructure.

To help reduce the burden on network bandwidth, Microsoft designed two different update types: Full and Express 1 .

If needed, customers may defer semi-annual Feature Updates via Settings > Windows Update > Advanced options or via an organization’s device management policies.

On devices that do not defer the installation of feature updates, the subsequent Semi-Annual Channel version of Windows 10 may be automatically offered and installed prior to the end date. Update deferral is not available for all versions of Windows 10 2 . Please see Windows as a Service (WaaS) for information on release channels and the Windows 10 release information page for additional update details.

Not all features in a feature update will be available on all devices. Similarly, a device may not be able to receive updates if the device hardware is incompatible, lacks current drivers, lacks sufficient storage space, or is otherwise outside the original equipment manufacturer’s (OEM) support period. For more information on compatibility, review the Windows 10 System Requirements as well as the Windows Processor Requirements.

Update availability may vary by country, region, network connectivity, mobile operator (e.g., for cellular-capable devices), or hardware capabilities (including, e.g., free disk space).

1 As of April 9th, 2019 Delta Updates are no longer be available. To learn more, go here.

2 Windows 10 Home does not support the deferral of feature updates and will therefore typically receive a new version of Windows 10 prior to the end-of-service date shown.

What happened to the End of Mainstream Support date for Windows 10 listings on the Lifecycle Product Search page?

In the Windows as a Service (WaaS) model, the concept of Mainstream Support does not apply to Semi-Annual Channels, as each Semi-Annual Channel will be serviced (receive monthly quality updates) for a limited time. Customers are required to move to a supported version (feature update) to continue to receive monthly quality updates with security and non-security fixes.

What are the requirements for servicing and updating the Windows 10 Long-Term Servicing Channel (LTSC)?

The Long-Term Servicing Channel (LTSC) is designed to be used only for specialized devices — for example, those that control medical equipment or automated teller machines (ATMs).

To receive monthly quality updates, customers must be on a supported version of Windows 10. Go here for support dates.

See Overview of Windows as a Service (WaaS) for more information on release channels and the Windows 10 release info page for additional update details.

Windows Server

What are the requirements for servicing and updating Windows Server 2016 (LTSC) and Windows Server (Semi-Annual Channel)?

To receive monthly quality updates, customers must be on a supported version of Windows Server. Go here for support dates.

Updates are cumulative, with each update built upon the updates that preceded it.

What is the Lifecycle Policy for Windows Server Update Services (WSUS)?

Previously a standalone product, Windows Server Update Services (WSUS) became a component of the Windows Server operating system beginning with Windows Server 2012. A component is defined as a set of files or features that are included with a Microsoft product, whether it is shipped with the product, included in a product service pack or update, or later made available as a web download for the product. As a component, WSUS follows the Lifecycle Policy for the product on which it is installed – Windows Server (the parent product).

Windows 8.1

What is the Lifecycle Policy for Windows 8.1?

Windows 8.1 reached the end of Mainstream Support on January 9, 2018, and will reach end of Extended Support on January 10, 2023. With the general availability of Windows 8.1, customers on Windows 8 had until January 12, 2016, to move to Windows 8.1 to remain supported.

Why were Windows 8 customers required to move to Windows 8.1 two years after the general availability?

Historically, Microsoft has taken a similar support approach related to service packs. When a Windows service pack is released, Microsoft provides customers 24 months of support for the prior service pack or original release. Unlike service packs that are typically a collection of fixes, Windows 8.1 has new features and enhancements, and was designed to give customers the ability to deploy this update similar to service packs. Therefore we are applying the service pack policy to Windows 8.1.

Windows 8.1 does not change any hardware requirements compared with Windows 8 and existing Windows Store apps will work with Windows 8.1. Business customers who had Software Assurance licensing received Windows 8.1 as a free update.

Windows Embedded

How does the end of support for Windows XP impact Windows Embedded products?

Windows Embedded products have their own distinct lifecycles, based on when the product was released and made generally available. It is important for businesses to understand the support implications for these products to ensure that systems remain up-to-date and secure. The following Windows Embedded products are based on Windows XP:

Windows XP Professional for Embedded Systems. This product is identical to Windows XP, and Extended Support ended on April 8, 2014.

Windows XP Embedded Service Pack 3 (SP3). This is the original toolkit and componentized version of Windows XP. It was originally released in 2002, and Extended Support ended on January 12, 2016.

Windows Embedded for Point of Service SP3. This product is for use in point of sale devices. It’s built from Windows XP Embedded. It was originally released in 2005, and Extended Support ended on April 12, 2016.

Windows Embedded Standard 2009. This product is an updated release of the toolkit and componentized version of Windows XP. It was originally released in 2008, and Extended Support ended on January 8, 2019.

Windows Embedded POSReady 2009. This product for point of sale devices reflects the updates available in Windows Embedded Standard 2009. It was originally released on 2009, and extended support ended on April 9, 2019.

Why does support for Windows XP Professional for Embedded Systems end with Windows XP?

Windows XP Professional for Embedded Systems is a specially licensed version of Windows XP Professional for industry devices, delivering the full features and functionality of Windows XP. Given this relationship, both operating systems followed the same release schedule and share the same timeline.

Why was Windows XP Embedded be supported for two years longer than Windows XP Professional for Embedded Systems?

Windows XP Embedded is a modular form of Windows XP, with additional functionality to support the needs of industry devices. It was released separately from Windows XP and provides a separate support lifecycle to address the unique needs of industry devices. Devices running Windows XP Embedded reached end of support in 2016.

What is the Lifecycle Policy for Windows Embedded 8.1 products?

Windows Embedded 8.1 falls under the same lifecycle policy as Windows Embedded 8 with support ending 7/11/2023. Customers have 24 months to move to Windows Embedded 8.1 to remain supported. This applies to Windows Embedded 8 Industry Enterprise and Industry Pro.

What is the difference in the Extended Support phase for Windows Embedded products versus regular Windows products?

The type of support provided in the Extended Support phase is consistent across all products. Critical security updates are made available for products until the published Extended Support end date. This allows businesses to ensure that they are up to date in protection against security attacks. Similar to Windows products, Embedded products also receive updates through Microsoft Update. No regular updates are being released for Windows Embedded products to the release channels of DPC (Device Partner Center), Windows Embedded Developer Update (WEDU) and Microsoft OEM Online (MOO).

Windows Silicon Policy

What is the Windows policy for silicon support?

Windows products will be supported for security, reliability, and compatibility on the latest silicon available at the time of release. This includes previous silicon generations still in support by the Original Equipment Manufacturer (OEM).

What is the Windows Lifecycle policy for Intel’s sixth generation of processors (also known as Skylake) released in late 2015?

Windows 7 and 8.1 Devices

Supported Skylake devices will receive applicable Windows security updates through the end of support. These systems should be upgraded to Windows 10 to continue receiving support after the period ends. Search here to see your product’s end of support dates.

Windows Embedded 7, 8, and 8.1

Skylake devices running Windows Embedded 7, 8, and 8.1 will be supported according to the lifecycle support policy for those products. During this supported period, these systems should be upgraded to Windows 10 to continue receiving support after the period ends. There is no supported device list for Windows Embedded.

Windows Server

The Windows Server platform is supported on certified or logoed hardware as listed in the Windows Server Catalog. Today, you can browse the catalog and find hardware that meets or exceeds our minimum server hardware requirements and has been successfully certified for supported Windows Server products. For Windows Server, the policy consists of five years of mainstream support followed by five years of extended support. This lifecycle impacts the timeframe for which new devices and systems can be certified. We allow new systems to be submitted for certification up to the point when the OS transitions to extended support.

Where can I learn more?

To identify what generation of processor you have, see Intel’s page on processor numbers. To see if your processor supports Windows 10, see Intel’s Product Specification page. Go here to learn more about the latest processor requirements for all Windows products. To find your Windows product end of support date, search the Product Lifecycle site.

Windows RT

What is the Lifecycle Policy for Windows RT?

Microsoft will make software updates, including security updates, available for Windows RT. Search here for your specific product and its corresponding Lifecycle Policy.

What is the Lifecycle policy for Microsoft Office Home and Student 2013 RT, the version of Office available on Windows RT?

Microsoft Office Home and Student 2013 RT has the same lifecycle policy as Windows RT.

How long will Microsoft support device hardware that runs Windows RT?

Please refer to hardware warranties for more information. More details can be found in the Hardware FAQ.

Windows Mobile

What is the Lifecycle Policy for Windows Mobile?

Go here to learn about the Lifecycle Policy for Windows Mobile.

Change Log

October 2020 edits
UPDATED the Windows 8.1 section.