Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need a way to remotely see when a computer rebooted. I have its hostname and am able to browse its file structure.

Would love to do this on Windows XP, Vista and 7 machines.

share|improve this question
up vote 1 down vote accepted

Check the System Event log. Every time Windows boots it logs it there.

You can do this locally, you can do it remotely via the GUI (run eventvwr.msc, then Action, Connect to Another Computer).

You can also use PowerShell: In my $profile file I have this function:

    function lastboot([string]$computer)
            Write-Host "Getting last boot time, please wait..."
            get-eventlog -ComputerName $computer system|?{ $_.eventid -eq 6009 }|%{ $_|ft timewritten,eventid;break}
share|improve this answer
For Windows 7: The restart will show under source as "USER32" Event ID is "1074". – gigaduck Apr 1 at 14:29
Yep, 1074 tells when/why it restarted, while 6009 is when it 'booted' after the restart. – Mark Allen Apr 20 at 19:31

You can do it easily using a wmi query in powershell:

$os = gwmi win32_operatingsystem -computername "remote_computername"
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.