Categories
Interior

How to use event viewer to find your pc’s boot time

Everybody owning a PC has had to deal with the resulting degradation of the system boot. You can use the Event Viewer to watch precisely how it takes for your machine to start and shut down. The Event Viewer allows us to easily monitor any fault or warnings. What you might not know is that every Windows event is logged into the Event Viewer. In this article, we will guide you through the whole procedure to use Event Viewer to find the boot time for your PC under Windows 10.

Use Event Viewer to find the boot time for your PC under Windows 10

To use Event Viewer to find the boot time for your PC under Windows 10, follow this procedure step by step.

Click the Search button on the taskbar. Type Event Viewer in the search box and then click the Event Viewer option as the following image is showing.

How to use event viewer to find your pc’s boot time

As soon as you click the Event Viewer option, the following screen will appear.

How to use event viewer to find your pc’s boot time

Navigate to the following path from the left side of the screen.

Event Viewer -> Application and Services Logs -> Microsoft -> Windows -> Diagnostic Performance -> Microsoft-Windows-Diagnostic-Performance/ Operational

As you go through the mentioned path, the most right side of the screen will have the following options.

How to use event viewer to find your pc’s boot time

Click the Filter Current Log option as highlighted in the above image. As you click the Filter Current Log option, the following dialogue box will appear on your screen.

How to use event viewer to find your pc’s boot time

Check the Warning checkbox and enter the ID then click the OK button as highlighted in the above image. Now the following screen will appear.

How to use event viewer to find your pc’s boot time

Double click on the Warning message as highlighted in the above image. After double clicking the warning message, the following dialogue box will appear.

How to use event viewer to find your pc’s boot time

Here you will be able to see the Boot Duration as highlighted in the above image.

Now to know the Shutdown time, again click the Filter Current Log option and the following dialogue box will appear.

How to use event viewer to find your pc’s boot time

Check the Warning checkbox and enter the ID then click the OK button as highlighted in the above image. Then the result will appear as the following image is showing.

How to use event viewer to find your pc’s boot time

Double click the most top warning message as highlighted in the above image. Then the following dialogue box will appear.

How to use event viewer to find your pc’s boot time

Now you will get to see the Shutdown Duration as highlighted in the above image.

Conclusion

By following this procedure, you will be able to use Event Viewer to find the boot time for your PC under Windows 10.

Event viewer can be used to find booting time of your PC.

What is Windows Event Viewer?

Windows Event Viewer helps administrators and users to view the event log files on a local or remote machine. Windows Event log files contain report of every event such as a failure to start a particular service or completion of an action. The Event Viewer uses unique event IDs to define each and every events. For example Event Id 100 is for Boot Performance Monitoring category. It contains different booting information like Boot duration, Boot start time, boot end time etc.

How to use event viewer to find your pc’s boot time

Event Viewer tracks information in different logs, which includes Application events, Security-related events, Setup events, System events, Forwarded events. Depending on the severity Application events can be classified as Error (Red), Warning (Yellow), or Information (Green). An Error indicates loss of data, where a warning shows the event that can create problems in near future. Information event describes the successful completion of an operation. System events are generated by Windows services and components. Security related events are generated by Local Security Authority Subsystem Service or lsass.exe.

Different programs can take the help of the log files to send error reports. This can help technical support team to well understand the problems.
Using this event viewer you can also know if someone has access your system in your absence and what actions did he perform. So, event viewer is very important to track and monitor security and system errors of your system.

In this article I will show you how to check the booting time of your machine using this Event Viewer. Follow the steps below.

Steps to find booting time of your machine

1. Press Windows Key + W and type “Event” in Settings Search bar. Select View event logs from the search result.

2. Event Viewer will launch. Go to Applications and Services Logs -> Microsoft -> Windows -> Diagnostics-Performance location by expanding corresponding options.

3. You will find an log entry named Operational under this folder. Double-Click on this log to open it.

How to use event viewer to find your pc’s boot time

4. You can see there are 30 events in this log file. In Action window, click on Filter Current Log… option.

How to use event viewer to find your pc’s boot time

5. In Filter Current Log window Check the Warning option and in Event ID field type 100 and Click OK.

How to use event viewer to find your pc’s boot time

6. Now, All events having Event ID of 100. and Level : Warning will be displayed. Each of these log files has the information of booting time for different boot seasons. Click on any entry.

How to use event viewer to find your pc’s boot time

7. You will see the booting time of your machine in milliseconds. (1 ms = .001 second)

How to use event viewer to find your pc’s boot time

That’s it. You can see the booting time of your machine for different system boots in other entries and can calculate an Average.

How to use event viewer to find your pc’s boot time

About Nick

Nick is a Software Engineer. He has interest in gadgets and technical stuffs. If you are facing any problem with your Windows, feel free to ask him.

Event viewer can be used to find booting time of your PC.

What is Windows Event Viewer?

Windows Event Viewer helps administrators and users to view the event log files on a local or remote machine. Windows Event log files contain report of every event such as a failure to start a particular service or completion of an action. The Event Viewer uses unique event IDs to define each and every events. For example Event Id 100 is for Boot Performance Monitoring category. It contains different booting information like Boot duration, Boot start time, boot end time etc.

How to use event viewer to find your pc’s boot time

Event Viewer tracks information in different logs, which includes Application events, Security-related events, Setup events, System events, Forwarded events. Depending on the severity Application events can be classified as Error (Red), Warning (Yellow), or Information (Green). An Error indicates loss of data, where a warning shows the event that can create problems in near future. Information event describes the successful completion of an operation. System events are generated by Windows services and components. Security related events are generated by Local Security Authority Subsystem Service or lsass.exe.

Different programs can take the help of the log files to send error reports. This can help technical support team to well understand the problems.
Using this event viewer you can also know if someone has access your system in your absence and what actions did he perform. So, event viewer is very important to track and monitor security and system errors of your system.

In this article I will show you how to check the booting time of your machine using this Event Viewer. Follow the steps below.

Steps to find booting time of your machine

1. Press Windows Key + W and type “Event” in Settings Search bar. Select View event logs from the search result.

2. Event Viewer will launch. Go to Applications and Services Logs -> Microsoft -> Windows -> Diagnostics-Performance location by expanding corresponding options.

3. You will find an log entry named Operational under this folder. Double-Click on this log to open it.

How to use event viewer to find your pc’s boot time

4. You can see there are 30 events in this log file. In Action window, click on Filter Current Log… option.

How to use event viewer to find your pc’s boot time

5. In Filter Current Log window Check the Warning option and in Event ID field type 100 and Click OK.

How to use event viewer to find your pc’s boot time

6. Now, All events having Event ID of 100. and Level : Warning will be displayed. Each of these log files has the information of booting time for different boot seasons. Click on any entry.

How to use event viewer to find your pc’s boot time

7. You will see the booting time of your machine in milliseconds. (1 ms = .001 second)

How to use event viewer to find your pc’s boot time

That’s it. You can see the booting time of your machine for different system boots in other entries and can calculate an Average.

How to use event viewer to find your pc’s boot time

About Nick

Nick is a Software Engineer. He has interest in gadgets and technical stuffs. If you are facing any problem with your Windows, feel free to ask him.

How to use event viewer to find your pc’s boot time

Computers slow down over time. There are a lot of reasons why this happens. A PC will boot the fastest after a clean install. But after installing a lot of different applications and falling behind on your general computer maintenance, your computer’s boot time will gradually increase.

You can use the Windows Event Viewer to track your boot time speeds to see how much your computer’s boot time has increased over a several month duration.

How To Use The Event Viewer To Find Your Computer’s Boot Time

To begin, you’ll first need to launch the Event Viewer. There are several ways to do this. The easiest way it to go to the Start button and then type Event Viewer into the search box. Or you can find the Event Viewer in the Administrative Tools section of the Control Panel.

How to use event viewer to find your pc’s boot time

After you launch the Event Viewer, click the Applications and Services Logs link in the left-hand pane.

How to use event viewer to find your pc’s boot time

Next, click the Microsoft folder, and then the Windows folder. You will then see a folder for Diagnostics Performance. And within that a folder called Operational. So the click through path is Microsoft>Windows>Diagnostics Performance>Operational.

How to use event viewer to find your pc’s boot time

After you double-click on Operational, you will see an option to Filter Current Log in the right pane. Click on that to filter the results.

How to use event viewer to find your pc’s boot time

Under the Event level, we want to tick the Warning box. In the Includes/Excludes Event IDs field, we want to type 100. Windows assigns each event an ID. This particular ID is associated with Windows starting up.

How to use event viewer to find your pc’s boot time

You can now sort these start-up events by date and time. Click on the Date and Time tab at the top so the dates are descending. Double click the most recent event to see your computer’s boot time.

How to use event viewer to find your pc’s boot time

The time is displayed in milliseconds. Divide that number by 1000 to get your most recent computer boot time. In this case, it took this computer 37 seconds to boot.

How to use event viewer to find your pc’s boot time

To see how much your boot time has increased over the months, scroll down the list and open a different date. In this case, this particular computer booted nearly twice as fast six months earlier at 19 seconds.

Now that we have a way to track our computer’s boot time, we can take measures to speed it up. To reduce your computer’s boot time, consider defragging your hard drive, uninstalling unnecessary programs, and reduce the amount of programs in your start-up folder.

Try this on your own computer and let us know your computer’s boot time over a six month duration.

How to use event viewer to find your pc’s boot time

There are times when a user wants to know the startup and shutdown history of a computer. Mostly, system administrators need to know about the history for troubleshooting purposes. If multiple people use the computer, it may be a good security measure to check PC startup and shutdown times to make sure the PC is being used legitimately. In this article we discuss two ways to keep track of your PC shutdown and startup times.

Using Event Logs to Extract Startup and Shutdown Times

Windows Event Viewer is a wonderful tool which saves all kinds of stuff that is happening in the computer. During each event, the event viewer logs an entry. The event viewer is handled by the eventlog service that cannot be stopped or disabled manually, as it is a Windows core service. The event viewer also logs the startup and shutdown history of the eventlog service. You can make use of those times to get an idea of when your computer was started or shut down.

The eventlog service events are logged with two event codes. The event ID 6005 indicates that the eventlog service was started, and the event ID 6009 indicates that the eventlog services were stopped. Let’s go through the complete process of extracting this information from the event viewer.

1. Open Event Viewer (press Win + R and type eventvwr ).

How to use event viewer to find your pc’s boot time

2. In the left pane, open “Windows Logs -> System.”

How to use event viewer to find your pc’s boot time

3. In the middle pane, you will get a list of events that occurred while Windows was running. Our concern is to see only three events. Let’s first sort the event log with Event ID. Click on the Event ID label to sort the data with respect to the Event ID column.

How to use event viewer to find your pc’s boot time

4. If your event log is huge, then the sorting will not work. You can also create a filter from the actions pane on the right side. Just click on “Filter current log.”

How to use event viewer to find your pc’s boot time

5. Type 6005, 6006 in the Event IDs field labeled as . You can also specify the time period under Logged.

How to use event viewer to find your pc’s boot time

  • Event ID 6005 will be labeled as “The event log service was started.” This is synonymous with system startup.
  • Event ID 6006 will be labeled as “The event log service was stopped.” This is synonymous with system shutdown.

If you want to investigate the Event log further, you can go through the Event ID 6013, which will display the uptime of the computer, and Event ID 6009 indicates the processor information detected during boot time. Event ID 6008 will let you know that the system started after it was not shut down properly.

You can also set up custom Event Viewer views to just view this information in the future. This saves you time, and you can set up custom views for the specific events you want to see. You can set up multiple Event Viewer views based on your needs, not just the startup and shutdown history.

Using TurnedOnTimesView

TurnedOnTimesView is a simple, portable tool for analyzing the event log for startup and shutdown history. The utility can be used to view the list of shutdown and startup times of local computers or any remote computer connected to the network. Since it is a portable tool, you will only need to unzip and execute the TurnedOnTimesView.exe file. It will immediately list the startup time, shutdown time, duration of uptime between each startup and shutdown, shutdown reason, and shutdown code.

How to use event viewer to find your pc’s boot time

Shutdown reason is usually associated with Windows Server machines where we have to give a reason if we are shutting down the server.

To view the startup and shutdown times of a remote computer, go to “Options -> Advanced Options” and select “Data source as Remote Computer.” Specify the IP address or name of the computer in the Computer Name field and Press the OK button. Now the list will show the details of the remote computer.

How to use event viewer to find your pc’s boot time

While you can always use the event viewer for detailed analysis of startup and shutdown times, TurnedOnTimesView serves the purpose with a very simple interface and to-the-point data. For what purpose do you monitor the startup and shutdown times of your computer? Which method do you prefer for monitoring?

Suspicious that someone else is logging on to your computer? See how to find who’s been using your computer when you’re away. The above methods can also help give you a clue that someone might be using your PC without your permission.

Related:

Crystal Crowder has spent over 15 years working in the tech industry, first as an IT technician and then as a writer. She works to help teach others how to get the most from their devices, systems, and apps. She stays on top of the latest trends and is always finding solutions to common tech problems.

Many users share their computer with another or other people. It can be your personal or work computer. Generally, in these cases, each person usually has their user account. That is to avoid conflicts and that everything works in a better way. But, it can always be the case that someone accesses your computer. Even if you do not share your PC with other people.

How to use event viewer to find your pc’s boot time

How to stop someone seeing and leeching your personal data?

There may be someone who accesses our computer without our permission. At first, we do not know what that person has done in that time with the use of our device. Hopefully, you may detect that a change in the browsing history or files.

But, this is not usually the most common case. Also, what do we do in this case? How do we see if someone has misused our equipment?

How to use event viewer to find your pc’s boot time

GhostCtrl, What is this virus and how to avoid in Android

So, we just have to ask Windows. We can check when our computer has been used. Also, we can have information that if we are the only ones who have used the machine or there has been another person who has even use it without our permission. You can quickly verify that as it is a straightforward process. Thanks to a tool called Event Viewer.

Windows Events Viewer

The Windows Event Viewer is a tool that is present in all current versions of the operating system. It does not matter if you have XP or Windows 10, going through all the others. It is present in all versions. Which makes it an advantageous measure to check if someone uses our computer. Where can we find the event viewer?

How to start Event Viewer?

To find the Event Viewer we have to go to the Control Panel. Once inside the route we have to follow is the following path:

System and Maintenance> Administrative tools. Also, we can open it directly from the Run menu. In this case, we can activate it using this key combination: Windows + R. To open the viewer, we write “eventvwr.msc” then click on accept.

Best Anti-Malware programs 2017 For your Computer

Also, the Event Viewer will provide us with a lot of information about what happens on our PC. We will be able to know everything that happens on the computer while we were away from it. We can see when Windows services are running when an application is installed or uninstalled. In short, everything that happens.

Who is using your PC?

What we want to know is if someone has used our computer. For that purpose, in the Event Viewer, we have to go to Windows Records. Once there, we enter System. All this we do from the panel that is on the left side. When we have opened, the group shows a large number of entries. This information is mixed. So we will have to filter it to find what we are looking.

How to use event viewer to find your pc’s boot time

We can do that from Actions and then the system, in the right side panel. Then click on current filter record. A new window will open and in the field of all id. of the event we have to indicate the following numbers: 1, 12, 13, 42. Why these numbers? Each one represents a different match.

  • Number 1 represents when the team has come out of suspension
  • The number 12 when the team started
  • Number 13 when we turned off the computer
  • Number 42 when it has entered into suspension or hibernation

How to use event viewer to find your pc’s boot time

Thanks to this information we will be able to see when we have turned on our PC, or when we have turned it off. Also, from this information, we can also check the dates and the exact time to connect any hardware lines and check if our suspicions were right or wrong. We can see it at times when we know we were not at home or if someone has used the computer.

Also, we have the option to save a file with this information. So we can always check this history that shows us the activity of our PC sharing team at all times. We will be able to see everything in great detail. How to see which user and at what specific time has accessed the computer.

As you can see, the Windows Event Viewer is a handy tool. Thanks to it we can look the activity of our computer at all times. So, check if someone has entered and carried out improper actions with our PC. We hope that you have found it useful, especially if you suspect that someone has used your equipment. What do you think of the Event Viewer?

How to use event viewer to find your pc’s boot time

Windows 10’s Event Viewer helps troubleshoot problems with apps or to see what your PC was doing most recently.

Table of Contents

How to open Event Viewer on Windows 10

The easiest way to access Windows 10’s Event Viewer is to search for it. Type Event Viewer into the Windows 10 search box and select the relevant result. It will open a new window for the Event Viewer, giving you access to many options and the Windows 10 event log.

Refer to other ways in the article: How to access Event Viewer in Windows 10.

Use Windows Event Viewer to read logs

If you want to see what apps are doing, their specific Windows 10 event log will give you all the information to work with. To access them, select Windows Logs > Applications in the left panel.

Also, if you want to see Security logs (security log), select Windows Logs > Security. To view the system log, go to Windows Logs > System.

The central window will then display all the recent logs that Windows and third-party applications have logged. You will be able to find the application that corresponds to each record by looking in the column Source.

Column Level will tell you what kind of log it is. The most common type is Information, where the application or service only logs one event. Some will be listed as Warning or Error and denotes that something is wrong. These labels are usually nothing serious, some simply emphasize that a service cannot contact the server – even if it can on the next attempt – or that an application crashes – even if you re-open it afterwards and it works fine.

Column Date and Time allows you to know exactly when an event occurs, helping you determine what could happen. Additionally, if you select an event, you can get more information in the bottom pane about what the event is about and additional notes that help explain it further.

How to use event viewer to find your pc’s boot timeIf you need more information, write down the Event ID

If you need more information, write it down Event ID. Searching for it online can give you more information to take action, if you think the facts suggest a problem that needs addressing.

How to find specific Windows 10 logs

If you are looking for a specific log, Windows Event Viewer has a powerful search tool that you can use.

1. Right click or tap and hold on a specific diary category and select Find.

2. In the box Find, search for anything you want. It can be app name, event ID, event level or anything else.

How to use event viewer to find your pc’s boot timeFind specific Windows 10 logs

How to use the Filter system to find Windows 10 logs

For a more detailed search that provides more parameters, you may want to use the system feature Filter to replace.

1. Right click or long press on a specific log category (Applications, Security, Setup, System or Forwarded Events) and select Filter Current Log. Also, choose Filter Current Log from compartment Actions on the right.

How to use event viewer to find your pc’s boot timeUse the Filter system to find Windows 10 logs

2. Select tab Filter if not done.

3. Use the available options to fine-tune your Event Viewer logs. Menu Logged helps you filter by the date or time the tool generated it. The event level allows you to highlight the type of log event you are looking for, such as Warning, Error or Information. And Source allows you to filter by specific application or service and you can also filter by keyword, specific user or computer device.

How to delete event log history on Windows 10

If you want to start from scratch and delete all existing logs to focus on the new ones that come in, clearing Event Viewer logs is a great way to do it.

1. Right-click or press and hold the event group that you want to delete in the left pane.

2. Select Clear Log.

3. To create a backup of existing logs before deleting them, select Save and Clear. Choose a save location and a name and then select Save. Also, if you want to delete them completely without any form of backup, choose Clear.

How to use event viewer to find your pc’s boot timeClear event log history on Windows 10

4. Repeat the steps as needed for any other log categories you want to delete.

I recently upgraded my PC to windows 10. Initially (the first two days) it was rocket fast at booting up – amazingly so.

Yesterday though something must have happened because now it takes 30 minutes to boot up. When it is finally running it is super-quick and everything works. It is just the crazy long boot time that is the problem.

It displays the Windows 10 icon briefly, then goes black for 30-35 minutes. Then it starts OK.

Details (I am not a technical person sorry).

PC has a 250GB SSD and 1TB HDD

Was running Windows 7 64bit before upgrade.

-Disabling and updating graphics drivers (no effect)

-Defrag Hard drives.

-Full system scan x2 with Nortons.

-Disable/enable “fast startup”

-Scan disk came up clean

I have a feeling it may be something to do with the communication between the SSD and HDD but have no idea how to assess this problem.

Any suggestions would be welcome,

Report abuse

Replies (16) 

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

Thank you for posting your query on Microsoft Community.

I appreciate you for providing details about the issue and we are happy to help you.

I recommend you to run the System Maintenance troubleshooter and check if it helps.

Follow the below steps:

1. Type troubleshooting in the search bar.

2. Select Troubleshooting .

3. Select View all on the top left corner.

4. Click on System Maintenance .

5. Follow the on-screen instructions to run the troubleshooter.

R eference: Refer to the following Microsoft article on Windows 10 help & how-to .

Kindly let us know if you need any further assistance with Windows. We are glad to assist you.

Report abuse

3 people found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

This post mentions a file called “Boot time custom view.zip”, it might help you see where the problem is. The problem is that you may have to join that Forum to get the file downloaded.

If you want to get things going yourself, and manually setup (boot time logging), try and follow these instructions.

If this is a recent occurrence then try fixing things via System Restore.

How to repair the operating system and how to restore the operating system configuration to an earlier point in time in Windows Vista (or 7, or 8).
http://support.microsoft.com/kb/936212/#appliesto

See, Control Panel\All Control Panel Items\Recovery\ Open System Restore

How does it boot into Safe Mode?

How to perform a clean boot to troubleshoot a problem in Windows Vista, Windows 7, or Windows 8
http://support.microsoft.com/default.aspx/kb/929135

Report abuse

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

All tests came up clear unfortunately and problem persists.

I will be trying a roll-back to Windows 7 this evening.

Report abuse

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Thanks for that. I tried a system restore but no luck unfortunately.

I will try Event Viewer this evening to see if I can identify the problem.

It is looking loke a rollback to Windows 7 might be in order though.

Report abuse

1 person found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Thanks for that. I tried a system restore but no luck unfortunately.

I will try Event Viewer this evening to see if I can identify the problem.

It is looking loke a rollback to Windows 7 might be in order though.

Give Joythar Microsoft support engineer Aug 21, 2015 fix a try:

It could be a compatibility issue with the new Fast Startup component.

Try the below steps and check:

Method 1:

  1. Open Control Panel / Power Options.
  2. On the Left side menu, select Choose what the power buttons do.
  3. Select Change settings that are currently unavailable.
  4. Scroll down to the Shutdown settings section.
  5. Remove the check mark from the Turn on Fast Startup option.
  6. Select the Save Changes Button.

Shut Down the computer, wait a couple of minutes and then use the Power Button to start the computer.

You may try from the command prompt and check as well it if it doesn’t fix the issue.

Method 2:

  1. Press Windows + X Hope
  2. Select Command prompt admin
  3. Type powercfg /hibernate on and press enter.

Our Software // Windows Services // 24×7 Operation

How to use event viewer to find your pc’s boot time

Here are four ways to determine when your windows service last started.

Solution #1: Search the Windows Event Logs with PowerShell

The Windows Event Logs hold a wealth of information about your computer’s activities. Indeed, a new record is added to the System event log whenever a windows service starts or stops.

The easiest way to find your service’s most recent start time is to use a specially crafted PowerShell command to search the System event log. For example, the following line will return the last time the “Print Spooler” service was started:

(Get-EventLog -LogName “System” -Source “Service Control Manager” -EntryType “Information” -Message “*Print Spooler service*running*” -Newest 1).TimeGenerated

Be sure to replace “Print Spooler” with the display name of the service you are investigating!

How to use event viewer to find your pc’s boot time

Solution #2: Search the Windows Event Logs using the Event Viewer

Instead of running a PowerShell command, you can also search the Event Log manually.

To find the event log record showing when your service was last started:

Open the Event Viewer from the Control Panel (search for it by name).

In the left-hand column, navigate to Windows Logs > System:

How to use event viewer to find your pc’s boot time

Click Find… on the right to bring up the Find window. Enter the name of the service and click the Find Next button to highlight the first matching record in the middle panel. We have entered Spooler, for the Windows Spooler service:

How to use event viewer to find your pc’s boot time

If necessary, keep clicking the Find Next button until a record saying that your service has “entered the running state” comes up. The Source should be Service Control Manager, and the time your service started will be displayed in the Logged value. The screenshot show that the Print Spooler service last started at 8:04:55 AM on January 7th 2017:

How to use event viewer to find your pc’s boot time

Solution #3: Figure out when the Service’s Process was Started

Each running windows service is backed by an underlying process. 99.9% of the time, that process was launched immediately when the service started. So finding the process start time will give us the service start time.

To find out when the service’s process was started:

Determine the process identifier (PID) of the service’s process using the SC command. For a service named MyService, run:

(Be sure to enclose the service name in quotes if it contains spaces.)

Here is the result for the Spooler service:

How to use event viewer to find your pc’s boot time

Make a note of the number on the PID line (1276 in the screenshot above).

Get-Process | select name, id, starttime | select-string

is the process identifier from step 1. The start time will come back in the result. Here is what we got for the spooler’s process (#1276):

How to use event viewer to find your pc’s boot time

Solution #4: Use the System Boot/Up Time (for Automatic Windows Services)

Most Windows Services start when your computer boots and run continuously, 24×7 in the background. For those services, the system boot time is a reasonable approximate.

You can run the built-in systeminfo command to discover when the system last started. Amongst the valuable information systeminfo returns, look for the “System Boot Time” line:

How to use event viewer to find your pc’s boot time

However, if you’re ever in a situation where you can’t remember the command to use, know that the Task Manager’s Performance tab shows how long the computer has been up (“Up time”). The system boot time is a simple calculation away.

How to use event viewer to find your pc’s boot time

So there are four easy ways to find out when your windows service started. Use whichever one best fits your situation. Good luck with your troubleshooting/investigation!