How To Tell What Time a PC Was Shutdown Last

Living in the same household or dorm with other people can leave your PC unprotected while you’re away. Your snoopy roommates might want to check what you’re doing on your computer while you’re in class thinking there’s no way you could ever tell they did it.

Little do they know that there is a way to determine when your PC was last shut down. You can easily find out if your PC was used while you were away, but you should keep it a secret. We will give you all the info you need to figure out if someone was using your computer behind your back.

In this article, you will learn how to do it on Windows 10 and Mac OS X.

Checking the Last Shutdown Time on Windows 10

Windows keeps a detailed Event Log of everything that goes on with the system. The logs can tell you all kinds of details on how you use your computer, including the time of every startup and shutdown. You can use the Event Log to figure out if someone had used your PC without permission quickly. You won’t be able to tell who it was, but you will, however, know that something was going on while you were absent.

How to Check the Last Shutdown Time Using the Event Viewer

Here is a detailed step by step process:

1. Open the Start menu.
   
2. Type “Event Viewer” in the search box and hit Enter.
   
3. Double-click on the Windows Logs folder in the left-hand pane.
   
4. Right-click on “System” and select “Filter Current Log…”
   
   
5. A window will pop up. You have to look for the Event Sources dropdown bar. Open the dropdown options and find “Power-Troubleshooter.” You will notice that there are a lot of options, so take your time and find the one you need. When you do, click OK.
   

The Event Viewer will then show you all the information you need. Look at the middle pane in the window. The top section will let you check all recent events. You can see the exact timestamps of all the times your computer was started in recent past. All the startups will be shown in the log in descending order. You will have to keep track of the last time you used the PC. If the computer was used while you were away, the log would show you the exact time it happened.

If you find a suspicious log, you can click on it and see what woke your computer up. The info will appear in the bottom section of the middle pane.

By now, you will have a clearer picture of what was going on. You can get more information on what your PC was used for by checking Recent Documents, your browser history, and other similar locations. Make sure to find all the clues before you start pointing fingers at your roommates.

How to Check the Last Shutdown Time Using the Command Prompt

With one simple command, you can easily check the last shutdown time on Windows 10.

1. Click the Start menu and type ‘com‘ into the Search bar. You can type out ‘command prompt‘, but it isn’t necessary.
2. Type ‘wevtutil qe system “/q:*[System [(EventID=1074)]]” /rd:true /f:text /c:1‘ into the command prompt and hit Enter.

I won’t go into too much detail about the above command, so here’s a quick and simple breakdown. A System event with an ID of 1074 is a shutdown, so you query the System logs for that ID and print it to the command prompt.

How to Check the Last Shutdown Time Using the Event Viewer Using Windows PowerShell

If you like to use PowerShell, then you’ll enjoy this tutorial on viewing a PC’s last shutdown time.

1. Start by opening the Windows PowerShell app. Click the Start menu and type ‘win‘ into the search bar, you can type out ‘windows powershell‘, but it isn’t necessary. Click on the app to open it.
2. Next, type in ‘Get-WinEvent -FilterHashtable @{logname = ‘System’; id = 1074} | Format-Table -wrap‘ and hit Enter.

I won’t go into a lot of detail about the command for the sake of brevity. The Get-WinEvent command will go through the logs looking for the 1074 Event ID and return the results in a neat table with the Format-Table -wrap command.

Last Shutdown Time Check on Mac OS X

Checking your last shutdown time on Mac is a little trickier. The information you end up with is not as accurate and precise as what you get from Windows, but it’s still good enough to give you an idea of what’s going on.

Here is what you do:

1. Click on the Spotlight icon and enter “Console” in the search bar. Open the Console app when you find it.
2. Click on the kernel.log found in the left sidebar. If you don’t have the left sidebar, click on “Show Log List” first, and expand /private/var/log.
3. Type “Wake reason: EC.LidOpen” without the quotes.

You will get a list of every time your Mac was awakened. You can see as far back as two weeks, so you can scroll down and find the exact time someone used your computer without permission.

Again, it’s critical that you keep track of the last few times you used the computer. You can’t tell who did it from looking at the logs, but you sure can figure out when it was used behind your back. If you find such a record, you will know for sure that someone was snooping around. You can also check the browser history, apps, and programs for a more detailed look into what was going on.

Last Shutdown Time on Linux

Given that most Linux distros utilize one of several kernels, the process will be similar for most.

1. Use shortcut keys or the menu to open up a terminal.
2. Next, type ‘last -x shutdown | head -1‘ into the terminal and hit Enter.

The last -x shutdown command is piped into the head -1 command, which returns the last shutdown time from the log instead of its entire contents.

Get Some Anti-Theft App

If you want to catch the suspect red-handed, you should get an anti-theft app designed for that purpose. These apps will run in the background, so the culprit won’t be able to tell if they are on. If someone turns your computer on, the app will record what’s going on. You can even connect it to your webcam to take a photo of the culprit. That way, you will have some actual evidence you can use to confront the person.

Have you ever suspected someone was using your PC without permission? How did you confirm if that was really the case? Share your experiences in the comments section below.