Sunday, January 25, 2015

Windows Server Shutdown and Boot Times

Subtitle: When Gumption failed

This SUNDAY! morning whilst Agata was investigating an Agile Java issue, she has asked a company Sysadmin

Agata: How do you find the Boot time of my Windows Server?

Sysadmin:  No Idea!

No doubt in an effort to keep my ancient mind active, she therefore shouted out that her husband Marcus should immediately sort it out!

Windows Shutdown Date and Time

Recall that System log event 1074 is  good indication of System Shutdown

  • start event viewer i.e. run   eventvwr.exe
  • Control-F to get a search box up.  Search or filter for ID's  1074, 6008

Windows Startup Date and Time

From winternals 

psinfo utility


Cygwin 64, UNIX utilities for Windows


NB: who --boot  ; did not work on Cygwin


systeminfo  |  find "System Boot Time"

System Boot Time:          2015-01-25, 09:33:31


If you recall that Windows event number 6005 is  an indication of the system log starting up then searching for this in the System Event log is also a possibility.  Also ID 6009. In Powershell

get-eventlog System | where-object {$_.EventID -eq "6005"} | sort -desc TimeGenerated


Windows Management Instrumation API calls  (executed from PowerShell )

((Get-WmiObject Win32_OperatingSystem).ConvertToDateTime((Get-WmiObject Win32_OperatingSystem).LastBootUpTime))

Sunday, January 25, 2015 09:33:31


  • Start event viewer i.e. run   eventvwr.exe
  • Control-F to get a search box up.  Or use filter
  • Search or filter for ID's 6009

  • Summary:
    When your Sysadmin can't even be bothered to use Google to look up something he/ she should have known already perhaps it is time to consider a different outsourcing company to care for Agata's servers.   

    No gumption , initiative or common sense I am afraid.

    Windows Events and Message number search
    Windows event 1074
    Windows event 6005
    Windows event 6009