How can I get the Windows last reboot reason

user_42826 0
Viewed 180316

I'd like to know what is the Windows API function (if any exists) that provides information about the last Windows reboot source. There are three main possible causes:

  1. The computer crashed on a blue screen
  2. A user or a program shutdown/restarted the computer
  3. A power lost

The more details I can get the better. However, I need to know at least which reason it is from the main ones.

I need to support Windows Vista and Windows 7.

Answer:

It seems that there is no direct API to get that information. Instead, we have to harvest the Windows Event Log. System reboot information is located in Event Viewer/Windows Logs/System. Here is the various information provided by the event ids:

  • 6005: Windows start-up
  • 6006: Windows shutdown (properly)
  • 6008: Windows shutdown (unexpectedly)

I do not yet get the difference between power lost and system crash, but it's a good start.

shutdown reboot winapi windows
3 Answers

Take a look at the Event Log API. Case a) (bluescreen, user cut the power cord or system hang) causes a note ('system did not shutdown correctly' or something like that) to be left in the 'System' event log the next time the system is rebooted properly. You should be able to access it programmatically using the above API (honestly, I've never used it but it should work).

user_2340530

You may automate your investigation for the last 5 days with this powershell script:

$today = Get-Date
$startDay = $today.AddDays(-5)
$eventIds=(6005,6006,6008,6009,1074,1076,12,13,43,109)
$systEvents=Get-WinEvent -LogName System 
$rebootEvents=$systEvents| Where-Object {$_.TimeCreated -gt $startDay} | Where-Object {$_.Id -in $eventIds}  
format-table TimeCreated,Id,Message -AutoSize -wrap -InputObject $rebootEvents

enter image description here

user_146745630
Related