0phoi5 Posted November 3, 2017 Share Posted November 3, 2017 Hi guys, Apologies if this is a bit of a simple question, I've not come across it before and a Google search yielded a lot of irrelevant results. Is there a simple way to tell if a PC was Restarted or Shut Down on it's last power down? As in, tell if the user selected 'Restart' or selected 'Shut Down' within Windows 7? Thank you. Quote Link to comment Share on other sites More sharing options...
Rkiver Posted November 3, 2017 Share Posted November 3, 2017 https://www.maketecheasier.com/see-pc-startup-and-shutdown-history-in-windows/ First result I pulled from google. https://www.google.ie/search?q=windows+7+logs+shutdown+restart&rlz=1C1CHBD_enIE760IE760&oq=windows+7+logs+shutdown+restart&aqs=chrome..69i57.4659j0j7&sourceid=chrome&ie=UTF-8 Quote Link to comment Share on other sites More sharing options...
0phoi5 Posted November 3, 2017 Author Share Posted November 3, 2017 (edited) 9 minutes ago, Rkiver said: https://www.maketecheasier.com/see-pc-startup-and-shutdown-history-in-windows/ First result I pulled from google. https://www.google.ie/search?q=windows+7+logs+shutdown+restart&rlz=1C1CHBD_enIE760IE760&oq=windows+7+logs+shutdown+restart&aqs=chrome..69i57.4659j0j7&sourceid=chrome&ie=UTF-8 Sorry, I don't think I was clear. I need to know whether the user Shut Down the PC completely, OR if they instead rebooted the PC. I can't see anywhere in Event Viewer where it states whether the 'shutdown transition' was due to a restart or an actual shut down. This is why the Google search yielded too many results. I need to know which out of the two options the user selected to power down the PC. They either selected 'Shut Down' or they selected 'Restart', I'm looking to find out which. Thank you. Edited November 3, 2017 by haze1434 Quote Link to comment Share on other sites More sharing options...
Just_a_User Posted November 3, 2017 Share Posted November 3, 2017 15 minutes ago, haze1434 said: I'm looking to find out which Maybe this? https://stackoverflow.com/questions/981306/how-to-detect-whether-windows-is-shutting-down-or-restarting Quote Link to comment Share on other sites More sharing options...
0phoi5 Posted November 3, 2017 Author Share Posted November 3, 2017 2 minutes ago, Just_a_User said: Maybe this? https://stackoverflow.com/questions/981306/how-to-detect-whether-windows-is-shutting-down-or-restarting Thank you. Unfortunately, I can't see that guys answer is relevant to Windows 7; the reg key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shutdown Setting does not exist. Quote Link to comment Share on other sites More sharing options...
Just_a_User Posted November 3, 2017 Share Posted November 3, 2017 1 minute ago, haze1434 said: Thank you. Unfortunately, I can't see that guys answer is relevant to Windows 7; the reg key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shutdown Setting does not exist. Was worth a shot. What about the last comment, seems to be aimed at Win7 Quote Link to comment Share on other sites More sharing options...
0phoi5 Posted November 3, 2017 Author Share Posted November 3, 2017 Unfortunately the first reply was to do with telling whether the PC was powered down at all, not which option was selected to power it down out of Shut Down or Restart. Quote Link to comment Share on other sites More sharing options...
Just_a_User Posted November 3, 2017 Share Posted November 3, 2017 (edited) 14 minutes ago, haze1434 said: Unfortunately the first reply was to do with telling whether the PC was powered down at all, not which option was selected to power it down out of Shut Down or Restart. I thought it could differentiate between which option was selected, as he says "determine what the user last selected from the Shut Down dialog" sorry didnt realize was only in <=WinXP my bad. The last comment on page says "Possible experimental solution for Windows7 could be the following. (I'm not sure if this works well with other localizations, therefore I would call it a workaround)" and states it returns "The following is an example of XML which is written to the event log when a PC is restarted:" Edited November 3, 2017 by Just_a_User Quote Link to comment Share on other sites More sharing options...
0phoi5 Posted November 3, 2017 Author Share Posted November 3, 2017 4 minutes ago, Just_a_User said: I thought it could differentiate between which option was selected, as he says "determine what the user last selected from the Shut Down dialog" sorry didnt realize was only in <WinXP my bad. The last comment on page says "Possible experimental solution for Windows7 could be the following. (I'm not sure if this works well with other localizations, therefore I would call it a workaround)" and states it returns "The following is an example of XML which is written to the event log when a PC is restarted:" Thanks. I can't see that Event Viewer IDs 6005 and 6006 show much, other than 'The Event log service was started/stopped'. Doesn't give the reasons. It looks like that 'Turned On Times View' application is not downloadable here at work so I can't test, but I believe it just takes the reasons a Windows Server was shut down from an actual pop-up that user's fill in, rather than whether Shut Down or Restart was selected by users on a PC (not a server). The reason I was attempting to acquire this info is that we have a wide-spread issue that can be resolved by users Shutting Down the PC completely (not selecting restart, but selecting shut down). Some users are coming back and saying it doesn't work, so we need to determine whether it's PICNIC or whether they really did Shut Down. Quote Link to comment Share on other sites More sharing options...
0phoi5 Posted November 3, 2017 Author Share Posted November 3, 2017 (edited) It looks like windows uses either EWX_SHUTDOWN (0x00000001) or EWX_REBOOT (0x00000002) on powering down the PC. https://msdn.microsoft.com/en-us/library/windows/desktop/aa376868(v=vs.85).aspx Currently trying to determine which one was run, very difficult to find a decent article on it though! I'll keep looking. Edited November 3, 2017 by haze1434 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.