6005 is showing the start of logging events, but I assume it will also show up in case of any reboots, i.e. Windows does not make a difference between a 'full start-up' or warm reboot.
If the purpose is to seek the first startup and last closedown only, one has to remove any double 6005 entries.
With me, event id 12 is the very first one and event id 13 is the last one.
12: The description for Event ID ( 12 ) in Source (
Microsoft-Windows-Kernel-General ) could not be found. Either the
component that raises this event is not installed on the computer or
the installation is corrupted.You can install or repair the component
or try to change Description Server.
13: The description for Event ID ( 13 ) in Source (
Microsoft-Windows-Kernel-General ) could not be found. Either the
component that raises this event is not installed on the computer or
the installation is corrupted.You can install or repair the component
or try to change Description Server.
The following information was included with the event (insertion
strings): 2012-12-25T18:23:26.070181000Z
PS: That aside, I have a number of instances where a few 6005's were logged, but no 6006 that follows. One has to manually add the actual log-off based on e.g. the last eventlog entry that day.
useful stuff... – Fernando Espinosa – 2014-09-09T21:57:01.693
Is there any way to know system login\sleep times? – Viktor Sehr – 2012-02-01T17:32:38.723
I don't have a clue how to create those views, even after I've read those pages. But, there is an easier way. Open up
Event Viewer
, clickWindows Logs
->System
. On the right side there isFilter Current Log...
, click on it and when the new window appears insert6006
onAll Event ID's
and clickOk
. This will show up only system shutdown events. Do the same for system startup. – machineaddict – 2013-08-13T09:05:50.270