13

My office PC restarts every Sunday at an unknown time for unknown reason. I wish to know when my PC restarts and most importantly reason for which it restarts. I suspect that there is a third party install that force PC to restart.

Could you let me know how to determine the date and time when the PC was restarted? My OS is Windows XP SP3.

Thanks.

  • One way is to use a video camera to record the screen on Sunday. There is a chance that the responsible program will perform actions which may be observable on the screen. – Alvin Wong Mar 4 '13 at 12:16
26

To help diagnose the restart, what you should first check is Event Viewer.

Just enter eventvwr in the run dialog (which can be called by pressing Win + R).

Under Windows Logs > System look for events from the "Kernel-Power". This will also show if the system unexpectedly restarted by a blue screen and show events prior to it.

event viewer showing events

If it was a blue screen you can view the BSOD using BlueScreenView.

bsod viewer by nirsoft

  • My OS is Windows XP and I don't see the options that you have pasted in screenshot (which is of Windows 8) – Romil N Mar 4 '13 at 10:07
  • sorry, it's a slightly different view: upload.wikimedia.org/wikipedia/en/f/f2/… but practically the same – jay Mar 4 '13 at 10:45
  • 4
    If the computer isn't a server, I tend to disable "Reboot on BSoD" so that I will always see it and know there's a problem. – Alvin Wong Mar 4 '13 at 12:18
  • 2
    Windows XP has almost exactly the same options as he described. You might have to dig a bit, but it's all there :) – NickG Mar 4 '13 at 14:08
  • @jay: I see your attached snapshot. Which event ID tells the PC was shutdown/restarted? – Romil N Mar 8 '13 at 12:38
18

If you open a command prompt and type systeminfo, the command will spit out some data, including when it was last booted.

More info here.

  • This command list down when the PC was restarted last. How to know when was the PC shutdown and the cause of it? – Romil N Mar 4 '13 at 10:05
  • 2
    @romilnagrani - You asked how to tell if the computer was rebooted. This answer tells how to do exactly that. Shutdown event is different from the computer rebooting. – Ramhound Mar 4 '13 at 15:34
3

Windows 7, open up a command prompt and type:

systeminfo | find /i "boot time"

You will see a single line showing when the computer was last booted:

System Boot Time:          2/26/2013, 4:33:35 PM

OR

Windows XP open up a command prompt and type:

systeminfo | find /i "system up time"

You will see a single line showing how long the computer has been up:

4 Days, 15 Hours, 31 Minutes, 36 Seconds
  • didn't show anything in my computer – user13267 Mar 5 '13 at 0:56
  • Try systeminfo | find /i "system up time" instead. On my computer it reports: 4 Days, 15 Hours, 31 Minutes, 36 Seconds – Adrian Pronk Mar 5 '13 at 9:07
  • I've confirmed that the top command works on my PC, and your command returns no result, Maybe it's an OS difference? I'm running 7. – David Mar 5 '13 at 17:57
  • @Jikag: And I'm running XP – Adrian Pronk Mar 6 '13 at 2:51
  • @AdrianPronk I have updated my answer to reflect your comments – David Mar 6 '13 at 16:43
2

It's likely it could be Windows Updates set to install on a Sunday night. Open Windows Update from the start menu and check the settings for when it is set to restart.

2
net statistics server

Entering this in the command prompt will give you the time the OS was started. From there, you can cross-reference with the Event Viewer to see what occurred before this time.

  • 1
    or net stats workstation. Remember, it reports the date in mm/dd/yyyy format which can be confusing. – Adrian Pronk Mar 5 '13 at 9:09
  • @AdrianPronk: It seems to report using whichever date/time format you've specified in Control Panel. – Karan Mar 13 '13 at 2:08
  • @karan: I have dd/MM/yyyy specified in control panel but still get the date displayed in mm/dd/yyyy format – Adrian Pronk Mar 13 '13 at 9:01
  • @AdrianPronk: net stats workstation just gave me "Statistics since 13-03-2013 11:09:10 PM". Pretty sure that's dd-MM-yyyy. Just saw that the question's about XP, so is that what you're still using? My results are from Win7. – Karan Mar 13 '13 at 18:14
  • mm/dd/yyyy format should be illegal, and users and dealers be booked into rehab or shot. Normally the most significant digit of numbers is on the left, each digit becoming less significant until the least significant digit on the right. E.g. we learned Hundreds, Tens, Units in grade 1 at school. 123 is 1 hundred, 2 tens, plus 3 units. In many civilised countries, dates are the same, i.e. yyyy on the left, then mm then dd. – DaveBoltman Jun 27 '18 at 7:02
1

You can see the NIC elapsed time since last time your computer was turned on | reboot at control panel-Network-Active Network by clicking on LAN

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.