Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to log startup and shutdown times in Windows XP? I mean logging these events in the system event log.

For example I can hack a jscript like this

// this is log_startup.js
var shell = WScript.CreateObject("WScript.Shell");
shell.LogEvent(0, "Startup timestamp = " + Date() );

and then adding it cscript /nologo log_startup.js to the startup menu folder but I would prefer a more Windows "native" way (and, by the way, I do not know how to detect the shutdown).

Thank you.

share|improve this question
up vote 3 down vote accepted

Open gpedit.msc, go to Security Settings - Auditing, enable auditing for system events (startup and shutdown). They will appear in the Security log.

share|improve this answer
+1 Thank you. I found the settings in gpedit.msc "Local Computer Policy","Computer Configuration","Windows Settings","Security Settings","Local Policies","Audit Policy","Audit system events". How can I configure the policy programmatically? – Alessandro Jacopson Jul 28 '11 at 6:31
@uvts_cvs: Try the auditusr command. I'm not sure if there is any programmatic way to access the audit settings; best is to deploy the group policy over Active Directory. – grawity Jul 28 '11 at 7:39

This information is already logged in the System Event Log.

Shutdown: Source = eventlog && Event ID = 6006
Startup: Source = eventlog && Event ID = 6009

If you need an approximate shutdown time in the event of an unexpected shutdown (e.g. BSOD or power loss), you'll need to use uptime.exe to enable the system heartbeat. It's available from MS KB 232243.

In Vista/7, system heartbeat is enabled by default. There are also more specific events that can be tracked.

Shutdown: Source = Kernel-General && Event ID = 13
Startup:  Source = Kernel-General && Event ID = 12
share|improve this answer
Thank you, but it seems to me they are the start/stop of the event log facility, do they directly map to startup/shutdown of the machine? – Alessandro Jacopson Jul 28 '11 at 6:50
Within a few seconds, yes. Event Log is one of the first things started and last to close. Ithas to be so that anything else can be reliably logged. – afrazier Jul 28 '11 at 9:54

I don't know about "hacking jscript" but...

Checkout this article on how to "How To Enable System Boot Time Logging using Process Monitor Tool"

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .