EdgeXplore

There’s nothing like coming back to your Windows PC to find that everything’s been refreshed. None of your apps are open. Your web browser tabs are gone, as is your browser itself. That document you were working on? Hopefully you autosaved, because it looks like your system reset for whatever reason.

While I can’t necessarily tell you the reason Windows restarted, it’s easy to see exactly when the reset occurred, and that might help you pinpoint the problem based on your own knowledge of what you’ve been doing. (Or, at the very least, you’ll have a good idea whether something like a scheduled Windows Update is to blame, versus a random, middle-of-the-night crash.)

To get started, fire up PowerShell and type in this command:

Get-EventLog -LogName System ? {$_.EventID -in (6005,6006,6008,6009,1074,1076)} ft TimeGenerated,EventId,Message -AutoSize -wrap

(If that doesn’t work, because Kinja can be fussy with characters, simply copy and paste it from this Quora answer.)

Wait a bit while PowerShell chugs, and you’ll eventually get a screen that looks like this:

Credit: David Murphy

It shouldn’t take a ton of sleuthing to figure out when your system shut down and started up. In the above example, you’ll see EventID 6006 and 1074 occurring at roughly the same time two days ago (March 22) at around 4:00 p.m. I shut down my computer then (hence the event log service stopping and the obvious “shutdown message” from EventID 1074). And I turned my computer back on at 5:20 that day, which is when Windows reported its product name at boot (EventID 6009) and the Event log service started up (EventID 6005).

While you’re staring at the log, you can also look for “unplanned” or “unexpected” shutdowns, which might give you another clue that your system crashed, had a power outage, or had some other, inexplicable reason for turning off.

Credit: David Murphy

You can also try searching for these events directly within Windows 10's Event Viewer. Simply open the Windows Logs folder and click on System, then start scrolling (or filtering) for the aforementioned EventIDs. While you’re at it, throw EventID “41" into the mix, which will let you know if your system rebooted without cleanly shutting down—one indicator that it potentially crashed, suffered a power loss, or just had a shutdown issue.

Updated 3/24/21: We originally published a version of this story in 2010; David Murphy updated it in 2021 (!) with new a faster way to use PowerShell, instead of Event Viewer, to find out when your system last rebooted. We also added new images.