Loading

Monday, January 4, 2010

Find Last Reboot Time in Windows 7, Vista and Windows 2008

Have you ever wanted a quick and easy way to know how long your Windows 7 (or Vista or Windows 2008 server) system has been running?  When it was last restarted or rebooted?  There are a few easy ways this can be done, most from the Windows command line.  So open a Windows command prompt and choose the one that works best for you.  (Most of these commands work with Windows XP, Windows 2003, 2000, etc.  See notes below for specifics.)
  • This first way will display how long the network service has been running.  Generally this will be very close to the same amount of time (within a minute or two) as Windows has been running.  It won't be accurate if you restart the network service.
    Note: I listed this first because it's the one I usually use.

    From a command prompt window run the following (the 'S' in 'Statistics' must be capitalized):
net statistics workstation | find "Statistics"
You can shortcut it as well using:
net stats work | find "Stat"
Result:


Or ever shorter use either of the following:
net stats work
netstats work |more
  • This next method uses the command 'systeminfo.'  Again from a command prompt run (make sure to capitalize 'S', 'B' and 'T':
systeminfo | find "System Boot Time"
Result:


You can use the following on XP, Windows 2003 and earlier (however this will give only the length of uptime and not the system boot time):
systeminfo | find "Up Time"

  • The third method uses WMI, more specifically wmic (Windows Management Instrumentation Command-line), but the output is a little cryptic:
wmic OS Get LastBootUpTime
Result: 20091220133343.981621-300, which can be intrepreted as year 2009, month 12, day 20, hour 13 (or 1:00 PM), minute 33, etc.  Note: be careful as this may be displayed as UTC time depending on your system - like with Amazon EC2 virtual servers for example.


  • You can always use the system event log (this only works on 2003/XP or older).  Of course, you could go to Control Panel and browse through the system event log, but let's do it through the command line with:
cscript c:\windows\system32\eventquery.vbs /fi "ID eq 6005" /l system
Over the years I have found system event log event 6005, "The Event log service was started." to be the the most consistent entry after a computer restarts, even from a power outage, BSOD or other event.  This command will also give you a history of system startups listed in the System event log.


  • Finally, you can use this handy PowerShell script:
    Get-WmiObject Win32_NTLogEvent -filter "LogFile='System' and EventCode=6005" | Format-Table ComputerName, EventCode, Message, TimeWritten

Just like with anything there are many ways to skin this cat, so choose your favorite one (or two to double-check data) and go for it.

7 comments:

  1. In the 'find' statement, instead of remembering when/what to capitalize, you can also use the '/i' switch.

    ReplyDelete
  2. Thanks this was useful

    ReplyDelete
  3. GREAT Post Thanks!!

    ReplyDelete
  4. Thanks,from Spain. Easy and very usefull.

    ReplyDelete
  5. You can also simply check the modification time of pagefile.sys, this way:

    dir /a c:\pagefile.sys

    the date shown is in effect the last boot time.

    ReplyDelete
  6. How about a method for telling when windows was last shut down? Without having to boot it again!

    Background: I need an accurate method of telling when a backup image of windows was taken (using ntfsclone from linux). Basically, I want to look at an ntfs partition, from linux, and determine when it was last shut down, with a high degree of accuracy and reliability. Any ideas?

    ReplyDelete
  7. Are you able to find this information out for a different computer on your network?

    ReplyDelete