17

My office PC restarts every Sunday at an unknown time for unknown reason. I wish to know when my PC restarts and most importantly reason for which it restarts. I suspect that there is a third party install that force PC to restart.

Could you let me know how to determine the date and time when the PC was restarted? My OS is Windows XP SP3.

Thanks.

Improve this question
1
  • One way is to use a video camera to record the screen on Sunday. There is a chance that the responsible program will perform actions which may be observable on the screen.
    – Alvin Wong
    Mar 4, 2013 at 12:16

6 Answers 6

Reset to default
29

To help diagnose the restart, what you should first check is Event Viewer.

Just enter eventvwr in the run dialog (which can be called by pressing Win + R).

Under Windows Logs > System look for events from the "Kernel-Power". This will also show if the system unexpectedly restarted by a blue screen and show events prior to it.

event viewer showing events

If it was a blue screen you can view the BSOD using BlueScreenView.

bsod viewer by nirsoft

Improve this answer
5
  • My OS is Windows XP and I don't see the options that you have pasted in screenshot (which is of Windows 8)
    – xorpower
    Mar 4, 2013 at 10:07
  • sorry, it's a slightly different view: upload.wikimedia.org/wikipedia/en/f/f2/… but practically the same
    – Jay Wick
    Mar 4, 2013 at 10:45
  • 4
    If the computer isn't a server, I tend to disable "Reboot on BSoD" so that I will always see it and know there's a problem.
    – Alvin Wong
    Mar 4, 2013 at 12:18
  • 2
    Windows XP has almost exactly the same options as he described. You might have to dig a bit, but it's all there :)
    – NickG
    Mar 4, 2013 at 14:08
  • @jay: I see your attached snapshot. Which event ID tells the PC was shutdown/restarted?
    – xorpower
    Mar 8, 2013 at 12:38
23

If you open a command prompt and type systeminfo, the command will spit out some data, including when it was last booted.

More info here.

Improve this answer
2
  • This command list down when the PC was restarted last. How to know when was the PC shutdown and the cause of it?
    – xorpower
    Mar 4, 2013 at 10:05
  • 2
    @romilnagrani - You asked how to tell if the computer was rebooted. This answer tells how to do exactly that. Shutdown event is different from the computer rebooting.
    – Ramhound
    Mar 4, 2013 at 15:34
5

Windows 7, open up a command prompt and type:

systeminfo | find /i "boot time"

You will see a single line showing when the computer was last booted:

System Boot Time:          2/26/2013, 4:33:35 PM

OR

Windows XP open up a command prompt and type:

systeminfo | find /i "system up time"

You will see a single line showing how long the computer has been up:

4 Days, 15 Hours, 31 Minutes, 36 Seconds
Improve this answer
5
  • didn't show anything in my computer
    – user13267
    Mar 5, 2013 at 0:56
  • Try systeminfo | find /i "system up time" instead. On my computer it reports: 4 Days, 15 Hours, 31 Minutes, 36 Seconds
    – Adrian Pronk
    Mar 5, 2013 at 9:07
  • I've confirmed that the top command works on my PC, and your command returns no result, Maybe it's an OS difference? I'm running 7.
    – David
    Mar 5, 2013 at 17:57
  • @Jikag: And I'm running XP
    – Adrian Pronk
    Mar 6, 2013 at 2:51
  • @AdrianPronk I have updated my answer to reflect your comments
    – David
    Mar 6, 2013 at 16:43
2

It's likely it could be Windows Updates set to install on a Sunday night. Open Windows Update from the start menu and check the settings for when it is set to restart.

Improve this answer
2 
net statistics server

Entering this in the command prompt will give you the time the OS was started. From there, you can cross-reference with the Event Viewer to see what occurred before this time.

Improve this answer
6
  • 1
    or net stats workstation. Remember, it reports the date in mm/dd/yyyy format which can be confusing.
    – Adrian Pronk
    Mar 5, 2013 at 9:09
  • @AdrianPronk: It seems to report using whichever date/time format you've specified in Control Panel.
    – Karan
    Mar 13, 2013 at 2:08
  • @karan: I have dd/MM/yyyy specified in control panel but still get the date displayed in mm/dd/yyyy format
    – Adrian Pronk
    Mar 13, 2013 at 9:01
  • @AdrianPronk: net stats workstation just gave me "Statistics since 13-03-2013 11:09:10 PM". Pretty sure that's dd-MM-yyyy. Just saw that the question's about XP, so is that what you're still using? My results are from Win7.
    – Karan
    Mar 13, 2013 at 18:14
  • mm/dd/yyyy format should be illegal, and users and dealers be booked into rehab or shot. Normally the most significant digit of numbers is on the left, each digit becoming less significant until the least significant digit on the right. E.g. we learned Hundreds, Tens, Units in grade 1 at school. 123 is 1 hundred, 2 tens, plus 3 units. In many civilised countries, dates are the same, i.e. yyyy on the left, then mm then dd.
    – Reversed Engineer
    Jun 27, 2018 at 7:02
1

You can see the NIC elapsed time since last time your computer was turned on | reboot at control panel-Network-Active Network by clicking on LAN

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .