Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 3 down vote favorite
1

Is it possible to log startup and shutdown times in Windows XP? I mean logging these events in the system event log.

For example I can hack a jscript like this

// this is log_startup.js
var shell = WScript.CreateObject("WScript.Shell");
shell.LogEvent(0, "Startup timestamp = " + Date() );

and then adding it cscript /nologo log_startup.js to the startup menu folder but I would prefer a more Windows "native" way (and, by the way, I do not know how to detect the shutdown).

Thank you.

share|improve this question

3 Answers

up vote 2 down vote accepted

Open gpedit.msc, go to Security Settings - Auditing, enable auditing for system events (startup and shutdown). They will appear in the Security log.

share|improve this answer
+1 Thank you. I found the settings in gpedit.msc "Local Computer Policy","Computer Configuration","Windows Settings","Security Settings","Local Policies","Audit Policy","Audit system events". How can I configure the policy programmatically? – uvts_cvs Jul 28 '11 at 6:31
@uvts_cvs: Try the auditusr command. I'm not sure if there is any programmatic way to access the audit settings; best is to deploy the group policy over Active Directory. – grawity Jul 28 '11 at 7:39
up vote 2 down vote

This information is already logged in the System Event Log.

Shutdown: Source = eventlog && Event ID = 6006
Startup: Source = eventlog && Event ID = 6009

If you need an approximate shutdown time in the event of an unexpected shutdown (e.g. BSOD or power loss), you'll need to use uptime.exe to enable the system heartbeat. It's available from MS KB 232243.

In Vista/7, system heartbeat is enabled by default. There are also more specific events that can be tracked.

Shutdown: Source = Kernel-General && Event ID = 13
Startup:  Source = Kernel-General && Event ID = 12
share|improve this answer
Thank you, but it seems to me they are the start/stop of the event log facility, do they directly map to startup/shutdown of the machine? – uvts_cvs Jul 28 '11 at 6:50
Within a few seconds, yes. Event Log is one of the first things started and last to close. Ithas to be so that anything else can be reliably logged. – afrazier Jul 28 '11 at 9:54
up vote 0 down vote

I don't know about "hacking jscript" but...

Checkout this MsGeek.com article on how to "How To Enable System Boot Time Logging using Process Monitor Tool"

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.