How can I get the Windows last reboot reason

Question

I'd like to know what is the Windows API function (if any exists) that provides information about the last Windows reboot source. There are three main possible causes:

1. The computer crashed on a blue screen
2. A user or a program shutdown/restarted the computer
3. A power lost

The more details I can get the better. However, I need to know at least which reason it is from the main ones.

I need to support Windows Vista and Windows 7.

Answer:

It seems that there is no direct API to get that information. Instead, we have to harvest the Windows Event Log. System reboot information is located in Event Viewer/Windows Logs/System. Here is the various information provided by the event ids:

• 6005: Windows start-up
• 6006: Windows shutdown (properly)
• 6008: Windows shutdown (unexpectedly)

I do not yet get the difference between power lost and system crash, but it's a good start.

Radiancy

Possible Duplicate: #1316358 – Donetta

This post is about C#, I need Windows API (C/C++) – Radiancy

Answer 1

This article explains in detail how to find the reason for last startup/shutdown. In my case, this was due to windows SCCM pushing updates even though I had it disabled locally. Visit the article for full details with pictures. For reference, here are the steps copy/pasted from the website:

1. Press the Windows + R keys to open the Run dialog, type eventvwr.msc, and press Enter.

2. If prompted by UAC, then click/tap on Yes (Windows 7/8) or Continue (Vista).

3. In the left pane of Event Viewer, double click/tap on Windows Logs to expand it, click on System to select it, then right click on System, and click/tap on Filter Current Log.

4. Do either step 5 or 6 below for what shutdown events you would like to see.

5. To see the dates and times of all user shut downs of the computer

   A) In Event sources, click/tap on the drop down arrow and check the USER32 box.

   B) In the All Event IDs field, type 1074, then click/tap on OK.

   C) This will give you a list of power off (shutdown) and restart shutdown type of events at the top of the middle pane in Event Viewer.

   D) You can scroll through these listed events to find the events with power off as the shutdown type. You will notice the date and time, and what user was responsible for shutting down the computer per power off event listed.

   E) Go to step 7.

6. To see the dates and times of all unexpected shut downs of the computer

   A. In the All Event IDs field type 6008, then click/tap on OK.

   B. This will give you a list of unexpected shutdown events at the top of the middle pane in Event Viewer. You can scroll through these listed events to see the date and time of each one.

7. When finished, you can close Event Viewer.

---

Other useful event IDs (source)

ID	Description
41	The system has rebooted without cleanly shutting down first.
1074	The system has been shutdown properly by a user or process.
1076	Follows after Event ID 6008 and means that the first user with shutdown privileges logged on to the server after an unexpected restart or shutdown and specified the cause.
6005	The Event Log service was started. Indicates the system startup.
6006	The Event Log service was stopped. Indicates the proper system shutdown.
6008	The previous system shutdown was unexpected.
6009	The operating system version detected at the system startup.
6013	The system uptime in seconds.

Sabella

Perfect. I used the Event Source filter with USER32 and found out that Dell recovery was rebooting my system. – Joiner

Thanks! Filtering System Events with event IDs of 6008, lists the critical events that caused shutdown. – Locular

This is essentially a link-only answer. In case the link becomes inaccessible, this answer becomes devoid of any useful information. Besides, the OP is asking for an API call. Your link provides the answer by navigating the user through a series of manual steps. This does not constitute a solution to the problem asked. – Orelie

It is weird.. It is telling me Administrator is calling shutdown. It has been happening more frequently recently and noticing that even more than once several minutes after each other. I must have been compromised :( – Zahavi

If the system rebooted due to a bugcheck/BSOD, the event ID will be 1001, not 6008. This link contains explanations of the different bugcheck codes you might find in the Event Viewer. – Libradalibrarian

Just got a reboot due to a bugcheck on Windows 10, it had both 6008 and 1001 event IDs. 1001 (bugcheck report) being the more informative one. 6008 just states "The previous system shutdown at <date+time> was unexpected" but does not give a reason. – Asynchronism

Answer 2

Take a look at the Event Log API. Case a) (bluescreen, user cut the power cord or system hang) causes a note ('system did not shutdown correctly' or something like that) to be left in the 'System' event log the next time the system is rebooted properly. You should be able to access it programmatically using the above API (honestly, I've never used it but it should work).

Alden

Found it, it's in the System event log. – Radiancy

I've noticed that this message appears when the system freezes: "The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly." This seems like a generic message. Does anyone know if there's a way to differentiate between bluescreens and system freezes? – Juicy

Answer 3

You may automate your investigation for the last 5 days with this powershell script:

$today = Get-Date
$startDay = $today.AddDays(-5)
$eventIds=(6005,6006,6008,6009,1074,1076,12,13,43,109)
$systEvents=Get-WinEvent -LogName System 
$rebootEvents=$systEvents| Where-Object {$_.TimeCreated -gt $startDay} | Where-Object {$_.Id -in $eventIds}  
format-table TimeCreated,Id,Message -AutoSize -wrap -InputObject $rebootEvents

Merriweather

Answer 4

There is a simple way using powershell.

powershell "Get-WinEvent -FilterHashtable @{logname = 'System'; id = 1074, 6005, 6006, 6008} -MaxEvents 6 | Format-Table -wrap"

you can set the max events to display too.

Depravity