How do I know when Windows was started or shut down?

Question

I need to develop a program in C # to find out when Windows was started or completed.

Is there a log file that I can read to find out Windows startup and shutdown times? Or do you have any idea how to do this?

EDIT:

With the help of Mr. Reed Copsie, the best answer can be found in this question .

Answer 1

You can use the classes in System.Diagnostics.Eventing.Reader to access system event logs.

Answer 2

According to this article, you can use WMI to get the latest download date / time .

// define a select query SelectQuery query = new SelectQuery(@"SELECT LastBootUpTime FROM Win32_OperatingSystem WHERE Primary='true'"); // create a new management object searcher and pass it // the select query ManagementObjectSearcher searcher = new ManagementObjectSearcher(query); // get the datetime value and set the local boot // time variable to contain that value foreach(ManagementObject mo in searcher.Get()) { dtBootTime = ManagementDateTimeConverter.ToDateTime( mo.Properties["LastBootUpTime"].Value.ToString()); // display the start time and date txtDate.Text = dtBootTime.ToLongDateString(); txtTime.Text = dtBootTime.ToLongTimeString(); } 

Answer 3

As Reed pointed out, you can access the event logs and see when they were created. AFAIK there are no special event records for starting / shutting down the system, but you can look for services that usually start / stop on Windows. Although using this approach means that it will not be 100% accurate, let's say if it crashes or it starts manually / stops / restarts. One of the events that I consider to be the most accurate is the EventLog service start / stop event.

 if (EventLog.Exists("System")) { var log = new EventLog("System", Environment.MachineName, "EventLog"); var entries = new EventLogEntry[log.Entries.Count]; log.Entries.CopyTo(entries, 0); var startupTimes = entries.Where(x => x.InstanceId == 2147489653).Select(x => x.TimeGenerated); var shutdownTimes = entries.Where(x => x.InstanceId == 2147489654).Select(x => x.TimeGenerated); } 

Edit

Turns out a shutdown event has occurred. You can replace Linq to get it:

 var shutdownEvents = entries.Where(x => x.InstanceId == 2147484722); 

Answer 4

You can use the "System Hours" performance counter to get the System Start Time:

  PerformanceCounter systemUpTime = new PerformanceCounter("System", "System Up Time"); systemUpTime.NextValue(); TimeSpan upTimeSpan = TimeSpan.FromSeconds(systemUpTime.NextValue()); Console.Out.WriteLine(DateTime.Now.Subtract(upTimeSpan).ToShortTimeString()); 

Hope this helps.

Answer 5

The last restart time can be found using this piece of code

 static void Main(string[] args) { TimeSpan t = TimeSpan.FromMilliseconds(System.Environment.TickCount); Console.WriteLine( DateTime.Now.Subtract(t)); } 

Answer 6

A few more options:

• Get date-time of last Windows close using .NET
• http://www.codeproject.com/KB/cs/GetLastRebootTime.aspx

Answer 7

System.Environment.TickCount has a limit of 24.8 days.
This is because TickCount is the value in milliseconds contained in the 32-bit value with TickCount .

The Windows API provides the following two functions:
GetTickCount - Returns 32- GetTickCount Value - Available from Windows 2000
GetTickCount64 - Returns 64- GetTickCount64 value - Available from Vista / Windows Server 2008

You can use GetTickCount64 as follows:

 using System.Runtime.InteropServices; [DllImport("Kernel32.dll")] static extern long GetTickCount64(); DateTime osStartTime = DateTime.Now - new TimeSpan(10000 * GetTickCount64());