There’s nothing like going back to your Windows PC and finding that everything has been updated. None of your apps are open. Your web browser tabs are gone, as is your browser itself. The document you were working on? Hopefully you automatically saved as your system was reset for some reason.
While I can’t necessarily tell you the reason for Windows restarting, it’s easy to tell when the reset took place and this can help you locate the problem based on your own knowledge of your activities. (Or at least you have a good idea whether something like a scheduled Windows Update was to blame, as opposed to an accidental crash in the middle of the night.)
First, start PowerShell and enter the following command:
Get-EventLog -LogName System |? {$ _. EventID -in (6005.6006.6008.6009.1074.1076)} | ft TimeGenerated, EventId, Message -AutoSize -wrap
(If that doesn’t work because Kinja can be finicky with characters, just copy and paste it this Quora answer.)
Wait a while while PowerShell chugs and you’ll eventually get a screen that looks like this:
Screenshot: David Murphy
G / O Media can receive a commission
It shouldn’t take much time to find out when your system shut down and started up. In the example above, you see EventID 6006 and 1074 at approximately the same time two days ago (March 22nd) around 4:00 p.m. I then shut down my computer (hence the event log service is stopped and the apparent shutdown message ”from EventID 1074). And I turned my computer back on at 5:20 a.m. that day. Then Windows reported its product name at boot (EventID 6009) and the event log service was started (EventID 6005).
As you stare at the log, you can also look for “unplanned” or “unexpected” shutdowns that may give you one more indication that your system crashed, had a power outage, or had some other inexplicable reason for the shutdown.
Screenshot: David Murphy
You can also try looking for these events directly in Windows 10’s Event Viewer. Just open the Windows Logs folder, click on System and start scrolling (or filtering) for the EventIDs above. While you’re at it, toss EventID “41” into the mix to see if your system restarted without a clean shutdown – an indicator that it may have crashed, suffered a power outage, or just a problem had with the shutdown.
Updated 3/24/21: We originally published a version of this story in 2010. David Murphy updated it in 2021 (!) With a new, faster way to use PowerShell instead of Event Viewer to find out when your system was last restarted. We also added new pictures.