158

How can I know when my computer running Windows 7 was last restarted?

I prefer a solution that doesn't involve searching the event log, but something like wmic or maybe cmd commands.

0

16 Answers 16

214

systeminfo command is almost right what you need. On English Windows 7 you can also do:

systeminfo | find /i "Boot Time"

Or with the help of WMIC:

wmic os get lastbootuptime

The main difference between Windows 7 and Windows XP that in Windows 7 Microsoft can show only last boot up time.


Also in Task Manager:

enter image description here

8
  • 3
    @RoyiNamir: With some googling list of reboots (looks very similar): Get-EventLog -LogName System | where { ($_.InstanceId -bAnd 0xFFFF) -eq 6006 }
    – m0nhawk
    Dec 24, 2012 at 15:08
  • 2
    "Boot Time" appears to be lying. It's telling me last Friday but I know I've shut down my computer several times since then.
    – mpen
    Oct 27, 2016 at 0:46
  • 6
    Be aware that systeminfo is localised. So "Boot Time" is only true for english versions of Windows. May 3, 2017 at 8:33
  • 2
    Localization for spanish-speakers: systeminfo | find /i "tiempo de arranque" for the spanish version of Windows. Feb 27, 2018 at 16:21
  • 4
    systeminfo | find /i "Systemstartzeit" for german
    – schoetbi
    May 7, 2019 at 13:05
34

Another way to do this is to use the following command which I tested successfully on Windows XP, Windows 7 and Windows 10:

net statistics workstation

It is faster than systeminfo while formatting the date (which wmic does not). You can find more informations on the net statistics command here: http://technet.microsoft.com/en-us/library/bb490714.aspx

Here is an example of the result:

example

More details on http://en.wikipedia.org/wiki/Uptime about the accuracy when determining system uptime.

Additional notes from the comments: this method determines when the workstation service was last started, not the computer uptime. While this should in general be the same, the 2 numbers might be different if you use sleep/hibernate.

5
  • 1
    any idea why this doesn't read the same as using systeminfo or wmic... it's probably negligible, but it differs on my system by over 2 minutes Dec 11, 2014 at 20:31
  • It does differ for aobut 40 seconds on my computer too. I don't have any idea why it's not exactly the same, I guess the service just boots a little bit latter. Some interesting info on en.wikipedia.org/wiki/Uptime
    – dan
    Dec 11, 2014 at 21:33
  • 2
    It differs by over nine months on mine :-) This is the only correct answer. It gives the actual datestamp of the last boot (or when whatever associated service started after bootup, so very close to it), whereas wmic, Task Manager, and systeminfo all seem to count backwards from the current time by the number of ticks the PC has been running. But if you put your computer to sleep (or hibernate) a lot, like I do, the actual total running time is much less than the time since the last boot (only thirty days in my case over the last several months), throwing off that calculation completely.
    – Cameron
    Feb 12, 2016 at 6:05
  • Thank you @cameron, I added a note at the end of my answer. The original question was really about when the computer started and not its uptime, so that's an important detail. Wikipedia does somewhat mention the difference in the uptime article I linked.
    – dan
    Mar 10, 2016 at 15:08
  • 1
    That isn't really the last "boot" time - it's the time that the Server or Workstation service started, depending which one you query stats for. Since these don't ever stop during a regular Windows session, it's a convenient approximation of last boot time.
    – oldmud0
    Jun 7, 2017 at 15:50
20

There's the LastBootUpTime property of the Win32_OperatingSystem class. You can use WMIC with this command:

wmic os get lastbootuptime

Or if you use Powershell, you can convert the time to something more readable than that annoying WMI datetime format:

Get-WmiObject -class Win32_OperatingSystem | Select-Object  __SERVER,@{label='LastBootUpTime';expression={$_.ConvertToDateTime($_.LastBootUpTime)}}

Note that in later versions of PowerShell, you can also use Get-CimInstance, which will automatically return the value as a datetime:

Get-CimInstance -Class Win32_OperatingSystem | Select-Object LastBootUpTime

The only irritating thing is that Get-CimInstance will sometimes change the name of some system fields from WMI objects, such as __SERVER here. You'd have to use either CSName or PSComputerName, which seems to work for me.

3
  • 20121217175810.414696+120 I think I need damn good calculator to calc time
    – Royi Namir
    Dec 24, 2012 at 14:43
  • 7
    @Royi Yeah, WMI timestamps are stupid. It's a CIM_DATETIME, which is the format required by the standard. It's yyyymmddHHMMSS.mmmmmmsUUU, using 24 hour time. Here, your last reboot time is Dec 17, 2012 at 5:58 PM. msdn.microsoft.com/en-us/library/windows/desktop/…
    – Bacon Bits
    Dec 24, 2012 at 14:53
  • 1
    Handy bonus of using the get-wmiobject method is it makes it trivial to get boot times of remote computers too. Just add "-computer <computername>" to the command (before the pipe)
    – camster342
    Oct 20, 2013 at 22:22
13

For Windows 10 users out there....

System Properties Windows 10 - Performance Up time

5
  • 3
    This shows you the uptime (i.e. how long the system is running) not the time when the system has been started as OP asked. May 3, 2018 at 20:25
  • 2
    True, but this is still useful.
    – tbc0
    Jul 13, 2018 at 17:29
  • 1
    Today my Windows 10 notebook is showing a bogus uptime. I shut it down last night, powered it on less than an hour ago, and Task Manager says it's been up for 5:19:40:10.
    – tbc0
    Oct 25, 2018 at 14:15
  • 1
    Windows 10 does not actually shut down when shut down, I forget why exactly. However, if you want the uptime timer to reset you must restart. Nov 1, 2018 at 18:16
  • 1
    @DawidFerenczyRogožan Current time - Uptime = The time OP asks for, right?
    – klutt
    Dec 4, 2019 at 15:48
8

Please note that as pointed out by Alex the /sleepstudy command wasn't added until Windows 8.1. /systempowerreport might work instead.

Note that some of these other answers never worked for me, like searching the event-log for example was always missing some entries. @Florisz's answer is also correct in that regard. Here is my solution:

In an administrator cmd shell, run the following command:

powercfg /sleepstudy /output sleepstudy.html

Then open the file sleepstudy.html in a browser. You will be greeted with amazingly organized statistics about shutdown/reboot/standby/hibernation from the last three days. (so, run periodically if you need)

An example of an output: (AFAIR, Showdown (Hybrid) means fast startup)

enter image description here

Source / Documentation | Also related

2
  • 3
    This is what I was looking for on Windows 10! I don't reboot, I normally shutdown. LastBootTime only refers to reboots on Windows 10.
    – tbc0
    Oct 25, 2018 at 14:34
  • Great answer. However, for me (Windows 10) it does not show the restarts from yesterday, only today.
    – Avatar
    Feb 1 at 7:09
4

Note most of these answers will give the last "restart" time as requested by the OP. But some of you who shutdown your computer rather than restart it will notice that the time doesn't match your boot time.

To get the true last start time, open a PowerShell command prompt (doesn't need to be run as an administrator):

Get-WinEvent -ProviderName Microsoft-Windows-Kernel-boot -MaxEvents 10 | Where-Object {$_.id -eq "27"}

Which will return:

ProviderName: Microsoft-Windows-Kernel-Boot

TimeCreated                      Id LevelDisplayName Message
-----------                      -- ---------------- -------
3/6/2021 1:00:00 PM              27 Information      The boot type was 0x1.

In the Message field you'll see one of these boot types:

Boot             Type Description
0x0              cold boot from full shutdown
0x1              hybrid boot (fast startup)
0x2              resume from hibernation

Counterintuitively, after a restart the boot type will be 0x0 but after a shutdown (with Fast Start) the boot type will be 0x1.

You can isolate the time value with:

Get-WinEvent -ProviderName Microsoft-Windows-Kernel-boot -MaxEvents 10 | Where-Object {$_.id -eq "27"} | select -ExpandProperty TimeCreated

Saturday, March 6, 2021 1:00:00 PM

The reason systeminfo | find "Boot Time" and other similar solutions give the last restart time rather than the time you booted Windows after a shutdown has to do with "Fast Startup" which is on by default (read more here: https://www.howtogeek.com/349114/shutting-down-doesnt-fully-shut-down-windows-10-but-restarting-it-does/).

I've always considered an explicit shut down to be a more thorough way of restarting a computer but in fact that seems to be incorrect under Windows 10 with Fast Startup enabled. However, you can force a "hard" shutdown even with Fast Startup enabled by holding down the shift key while clicking "Shut Down" from the start menu.

3

On just about any version of windows you can check the timestamp on the swap file.

dir /a:h c:\pagefile.sys

1
  • 1
    I don't think so. At least on Windows 10, when I checked, the swap file time was newer than boot time.
    – tbc0
    Jul 13, 2018 at 17:30
3

You can use PowerShell for this.

Shutdown


Get-WinEvent -LogName Microsoft-Windows-Diagnostics-Performance/Operational | Where { $_.Id -eq 200 }

This will give you a list of logged shutdown times.

Alternative command, better optimized for remote connections:

Get-WinEvent -FilterHashtable @{LogName = "Microsoft-Windows-Diagnostics-Performance/Operational"; Id = 200; }

Example output:

TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
2017-01-28 18:25:46            200 Critical         Windows has shutdown
2016-11-01 19:55:21            200 Error            Windows has shutdown
2016-10-29 00:18:38            200 Critical         Windows has shutdown
2016-10-26 23:16:55            200 Warning          Windows has shutdown
2016-10-26 15:37:40            200 Warning          Windows has shutdown
2016-10-26 02:18:24            200 Warning          Windows has shutdown
2016-10-26 02:10:34            200 Warning          Windows has shutdown
2016-10-26 02:04:01            200 Warning          Windows has shutdown
2016-10-25 14:23:11            200 Warning          Windows has shutdown
2016-10-25 13:07:46            200 Error            Windows has shutdown
2016-10-25 00:18:12            200 Error            Windows has shutdown
2016-10-19 13:16:39            200 Critical         Windows has shutdown

Startup


The following command will give you a list of logged startup times.

Get-WinEvent -LogName Microsoft-Windows-Diagnostics-Performance/Operational | Where { $_.Id -eq 100}

Alternative command, better optimized for remote connections:

Get-WinEvent -FilterHashtable @{LogName = "Microsoft-Windows-Diagnostics-Performance/Operational"; Id = 100; }

Example output:

TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
2017-10-07 21:35:38            100 Critical         Windows has started up
2017-01-28 18:25:48            100 Critical         Windows has started up
2016-12-11 17:45:07            100 Critical         Windows has started up
2016-11-16 13:26:52            100 Critical         Windows has started up
2016-11-01 19:55:21            100 Critical         Windows has started up
2016-10-29 00:18:39            100 Critical         Windows has started up
2016-10-26 23:16:55            100 Error            Windows has started up
2016-10-26 14:51:07            100 Error            Windows has started up
2016-10-26 02:24:01            100 Error            Windows has started up
2016-10-26 02:18:24            100 Critical         Windows has started up
2016-10-26 02:10:34            100 Error            Windows has started up
2016-10-26 02:04:01            100 Critical         Windows has started up
2016-10-25 14:23:12            100 Error            Windows has started up
2016-10-25 13:07:47            100 Error            Windows has started up
2016-10-25 12:56:23            100 Error            Windows has started up
2016-10-19 13:16:39            100 Critical         Windows has started up

I have tested this on PowerShell 5.1 and Windows 10.0.15063. But it should work on Windows 7 as well, as long as you have at least PowerShell 3.0. Note that you need to run it as admin.

You will find the full documentation for the command here: docs.microsoft.com

2
  • Didn't work for me on Windows 10. Not even as admin. See snag.gy/HcEn8j.jpg
    – tbc0
    Jul 13, 2018 at 17:27
  • Worked for me. This is the answer if you need a list of startup events/reboots.
    – Avatar
    Feb 1 at 7:14
3

To get it in PowerShell:

Function Get-LastBoot {
        if ($Host.Version.Major -lt 3) {
            Get-WmiObject win32_operatingsystem | Select-Object CSname, @{n = 'LastBootUpTime'; e = {$_.ConverttoDateTime($_.lastbootuptime)}}
        }
        else {
            Get-CimInstance -ClassName win32_operatingsystem | Select-Object CSname, LastBootUpTime
        }
    }

Here's the result:

CSname  LastBootUpTime
------  --------------
LAPTOP1 2018-09-07 08:57:02
2

On Windows 7 I prefer

net statistics workstation

WMIC doesn't take into account sleep time, and I leave my workstation locked up at work sleeping during the week, ready to wake up the next day.

2

yet another way in a batch file to get boot time with wmic but in human readable form :

for /f %%a in ('WMIC OS GET lastbootuptime ^| find "."') DO set DTS=%%a
set BOOTTIME=%DTS:~0,4%-%DTS:~4,2%-%DTS:~6,2%  %DTS:~8,2%:%DTS:~10,2%
echo DTS      : %DTS%
echo BOOTTIME :%BOOTTIME%

output :

DTS : 20170308073729.491206+060

BOOTTIME : 2017-03-08 07:37

1
  • 2
    This answer would be better if it included an explanation of how the set BOOTTIME works.
    – user
    Mar 28, 2017 at 13:31
2

From a similar ServerFault question, search/filter the Windows System Event Log for Event ID 6009.

On Windows 10: Event Viewer > Windows Logs > System and then the Filter Current Log... Action.

2

A couple of answers mentions net statistics workstation and I've noted that both :

net statistics server

and

net statistics workstation

should provide data regarding last boot on the Statistics since ... line.

However, some OS versions (like Svr2008/6.0) will return 1/1/1980 12:00 for the date when using server. So I'll default to workstation.

Also you can abbreviate some of the command like net stats workstation and get the same results. Finally, if you jump around from system to system, the default CMD box isn't large enough to show all results from the command. So I'll pipe the output to more to avoid scrolling up to see the boot time. Therefore, my default command is:

net stats workstation | more

command

1

I want to add, that all these commands really give you the timestamps when a 'restart' or 'reboot' is done. And not when a shutdown and start is done. After shutdown and start the 'lastbootuptime' will reflect the time the system is really 'restarted' and not the actual boot up time. So shutdown/start gives the same result as coming back from suspend/hybernnate for the LastBootUpTime timestamp.

1

You can use Get-Uptime in PowerShell 6.0 or greater, or if you install PowerShell Community Extensions (Pscx) module if you're on PowerShell 5.1

Output looks like this from Pscx 3.3.2
Pscx does not have the -since option

Get-Uptime

Uptime              LastBootUpTime
------              --------------
11.01:20:06.7927825 11/08/2023 12:45:12 PM
0

Same as Max answer ...

for /f %%a in ('WMIC OS GET lastbootuptime ^| find "."') DO set DTS=%%a
set BOOTTIME=%DTS:~0,4%-%DTS:~4,2%-%DTS:~6,2%  %DTS:~8,2%:%DTS:~10,2%
echo DTS      : %DTS%
echo BOOTTIME :%BOOTTIME%

...but in oneliner:

for /f %a in ('WMIC OS GET lastbootuptime ^| find "."') DO set DTS=%a && echo %DTS:~0,4%-%DTS:~4,2%-%DTS:~6,2% %DTS:~8,2%:%DTS:~10,2%

This wmi implementation may appear a little messy but it's very fast compared to other powershell or systeminfo implementations and you can easily change the format since it's explicit in the code.

Thank you Max.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .