Thursday, 19 May 2016

Last Shutdown time on Windows

Checking the last shut down time on Linux is as simple as reading through logs. On Windows, it is not as straight forward though. Recently, I needed to find the last shutdown time of my Windows desktop. I knew System events is what I should be looking at but searching through the logs is not as easy as a regular expression. After some reading, I found that I can filter the log with the following parameters to search for the shutdown events.

Event source: USER32
Event Id: 1074