Monday, January 4, 2010

Find Last Reboot Time in Windows 7, Vista and Windows 2008

Have you ever wanted a quick and easy way to know how long your Windows 7 (or Vista or Windows 2008 server) system has been running?  When it was last restarted or rebooted?  There are a few easy ways this can be done, most from the Windows command line.  So open a Windows command prompt and choose the one that works best for you.  (Most of these commands work with Windows XP, Windows 2003, 2000, etc.  See notes below for specifics.)
  • This first way will display how long the network service has been running.  Generally this will be very close to the same amount of time (within a minute or two) as Windows has been running.  It won't be accurate if you restart the network service.
    Note: I listed this first because it's the one I usually use.

    From a command prompt window run the following (the 'S' in 'Statistics' must be capitalized):
net statistics workstation | find "Statistics"
You can shortcut it as well using:
net stats work | find "Stat"

Or ever shorter use either of the following:
net stats work
netstats work |more
  • This next method uses the command 'systeminfo.'  Again from a command prompt run (make sure to capitalize 'S', 'B' and 'T':
systeminfo | find "System Boot Time"

You can use the following on XP, Windows 2003 and earlier (however this will give only the length of uptime and not the system boot time):
systeminfo | find "Up Time"

  • The third method uses WMI, more specifically wmic (Windows Management Instrumentation Command-line), but the output is a little cryptic:
wmic OS Get LastBootUpTime
Result: 20091220133343.981621-300, which can be intrepreted as year 2009, month 12, day 20, hour 13 (or 1:00 PM), minute 33, etc.  Note: be careful as this may be displayed as UTC time depending on your system - like with Amazon EC2 virtual servers for example.

  • You can always use the system event log (this only works on 2003/XP or older).  Of course, you could go to Control Panel and browse through the system event log, but let's do it through the command line with:
cscript c:\windows\system32\eventquery.vbs /fi "ID eq 6005" /l system
Over the years I have found system event log event 6005, "The Event log service was started." to be the the most consistent entry after a computer restarts, even from a power outage, BSOD or other event.  This command will also give you a history of system startups listed in the System event log.

  • Finally, you can use this handy PowerShell script:
    Get-WmiObject Win32_NTLogEvent -filter "LogFile='System' and EventCode=6005" | Format-Table ComputerName, EventCode, Message, TimeWritten

Just like with anything there are many ways to skin this cat, so choose your favorite one (or two to double-check data) and go for it.


  1. In the 'find' statement, instead of remembering when/what to capitalize, you can also use the '/i' switch.

  2. Thanks this was useful

  3. GREAT Post Thanks!!

  4. Thanks,from Spain. Easy and very usefull.

  5. You can also simply check the modification time of pagefile.sys, this way:

    dir /a c:\pagefile.sys

    the date shown is in effect the last boot time.

  6. How about a method for telling when windows was last shut down? Without having to boot it again!

    Background: I need an accurate method of telling when a backup image of windows was taken (using ntfsclone from linux). Basically, I want to look at an ntfs partition, from linux, and determine when it was last shut down, with a high degree of accuracy and reliability. Any ideas?

  7. Are you able to find this information out for a different computer on your network?