hi. I'm trying to learn last shutdowntime of computer. I look system/controlset001/control/windows shutdowntime but there is last written time not shutdowntime. how can I learn?
Bear in mind that a recorded shutdown might not be the the last point a computer was used. (holding the power button, for a hard power off, or pulling the plug etc, would mean nothing was recorded)
If its a vista box, you may be looking for event 1074 in the system event log.
You can use the Event Viewer to see recorded shutdown times.
Control Panel ->Administrative Tools ->Event Viewer
Event ID 6006 in the system log will show when the service was stopped.
If you have an improper shutdown, you can look at the last recorded event log, the last time a registry file was updated or the last date on any file. Realize, though, if the hard drive was connected as a slave to another computer, the file dates may not be reliable.
EV message 6006 is a "'graceful' shutdown." As gkelley mentioned, there are also improper shutdowns; there are seg faults, power interruptions (cord/battery pulled), etc..
If you run Helix's PC On-Off, it parses the Windows Event Logs looking only for specific event enumerations … you'll see just how unreliable taking an automated look at Event Viewer will be, and just how little help relying on finding proper shutdown numbers provides.
Reading through the logs yourself and then referencing http//
A faster (though unreliable) DB is here http//
-Ryan
If the PC wasn't shutdown cleanly, then assuming any kind of regular disk activity, you can parse the $logfile to see when the PC was last used prior to dirty shutdown.
thank everybody