Find out when your computer was turned on or off while you were away
It's all about security and privacy, especially if you live in a college dorm with a group of friends or even if you're worried that your kids or family members might turn on your computer without your knowledge. In these cases, and perhaps others, you may want to check the times your computer was turned on to see if anyone else is trying to use your device while you're away.
Sure, you can secure yourself by using a strong password to log in to Windows, but suppose someone guessed your Windows password , then they will be able to log in to Windows and access your files if you do not protect them from the inside with any additional protection . Sure, you can easily change your Windows password . However, to eliminate any doubt, and to make sure if someone is trying to intrude on your privacy and confidential data, you should track the times when your computer was started and shut down. This is what we will actually explain through this guide. If it turns out that there are cases of turning on the computer at times that do not coincide with your presence at home, this is a strong indication that someone else is trying to turn on your device while you are away. Then you can start taking more strict measures to protect your confidential data.
The first method: Through the Event Viewer tool
The Event Viewer is primarily used for troubleshooting. It is a great place to check for the causes of problems that occur on Windows when running an application or game. If you are facing a strange problem on Windows and are completely hopeless at finding out what caused it, you should start with the Event Viewer to get the cause of the problem and look for the code (code) attached to the problem report and search for it on the Internet.
All the events that occur on your computer are stored and recorded inside the Event Viewer. When you start a program, open a browser, run a game, install a program or anything else, all the events are recorded in the Windows Logs inside the Event Viewer, and of course the times when your computer starts and shuts down are no exception.
To determine the computer’s startup and shutdown times, you need to look for the code 6005 which refers to the time the computer was turned on, while the code 6006 refers to the time the event viewer was closed and the resulting shutdown of the computer. Now to open the event viewer, click on the Windows + R shortcut to open the Run window and start searching for eventvwr and click on the Ok button . Once the event viewer is open, expand the “ Windows Logs ” options and then click on the “ System ” option.
In the middle of the window you will find all the entries that were recorded when the device was running in recent times. To make it easier to find specific events, right-click on the word Level at the top and choose Sort Events By This Column . Wait a few moments for the events to be sorted.
If the system fails to sort events because it has too many of them, you can instead click the Filter Current Log option from the panel on the right side.
Then from the new window, search for the following codes: 6005, 6006 inside the All Event IDs field as shown in the previous image. It is worth noting that you can specify a specific range of appointments through the Logged box , then change the Any Time option to other times, and finally click Ok to start the narration process.
There are some codes that may interest you while checking the results, including the following:
Event ID 41: This event is an indication that the computer has performed a reboot without shutting down. This code usually appears with power instability or restarting the computer from the power button or from the main power menu.
Event ID 1074: This code usually appears when a program causes a complete shutdown of the computer, including programs that set the time to shut down the computer according to a specific schedule or perhaps for other reasons.
Event ID 1076: This code describes the reason why your computer shut down or restarted. This code is often used if you are experiencing sudden computer shutdowns without any reason.
Event ID 6005: This code indicates the time when the Event Viewer was launched, and therefore also indicates the time when the computer was turned on since the Event Viewer runs automatically as soon as the computer starts and cannot be stopped by the user.
Event ID6006: This code indicates when the Event Viewer stopped and what resulted in the computer shutting down completely.
Event ID 6008: This code appears when the computer experiences a sudden shutdown, such as a power outage.
Event ID 6009: This code appears with different messages depending on the type of CPU. In most cases it is an indication of the time at which the CPU in the computer was started.
Event ID 6013: This code shows the length of time the computer has been active since it was last turned on. For example, if the computer has been running for 24 hours, this code should show you that length of time.
Second method: Through the command prompt CMD/PowerShell
Although the Event Viewer is the preferred place to find your computer's startup and shutdown logs, some of you may not want to use it because of the confusion that the codes and messages attached to them can cause. No problem, you can rely on the Command Prompt, and through a simple command line, you can find out when your computer starts up and shuts down.
Click on Windows Key + R shortcut and then start searching for CMD and then click on Ctrl + Shift + Enter shortcut to open Command Prompt with administrator privileges. Copy and paste this command inside Command Prompt and then click on enter key :
wevtutil qe system "/q:*[System [(EventID=6006)]]" /rd:true /f:text /c:1
The command we used above includes the Event ID 6006 code which should indicate when the Event Viewer was last shut down. If you want to execute a bunch of codes together, you'll need to use a PowerShell prompt. Click the Windows key + X shortcut, choose Terminal (Admin) from the pop-up menu, and then type the following command:
Get-EventLog -LogName System |? {$_.EventID -in (6005,6006,6008,6009,1074,1076)} | ft TimeGenerated,EventId,Message -AutoSize -wrap
The process will take a few moments before you get any result. But you will notice that the results here are much more compared to the result you can get from Command Prompt.
Method 3: Using TurnedOnTimesView Tool
Let's be honest: both of the above methods are not easy for regular users, right? Well, there is only one method left through the TurnedOnTimesView tool , which fortunately supports the Arabic language. The tool is only 85 MB in size, does not require installation, and is compatible with all versions of Windows starting from Windows XP to Windows 11. Run the tool after extracting it, then click on the "Options" tab, then choose "Advanced Options" and from here you can choose "Local Computer" or "Remote Computer" on the network.
If you want to check your computer, you can leave the “Local Computer” option and then go back to the main screen of the tool and check the “Restart Duration” which shows the times the computer was turned on and also check the “Shutdown Duration” which shows the times the computer was shut down and the “period” the computer was turned on and off. Unfortunately the tool is not perfect in translating the Arabic language, but it is still a simpler method than the previous methods.
Unfortunately, you can't rely on the "Shutdown Cause" report because it gives inaccurate results. If you're not happy with your experience with this tool, you can use alternatives like Shutdown Logger or LastActivityView . But personally, I haven't found a better way to view these events accurately and clearly than the default Event Viewer in Windows.