How to find out how often Windows Seven has rebooted?

18

5

Where on the system or registry should I look for data on how many times Windows has been rebooted? I want to create an application that uses this information (how many times Windows has rebooted since the OOBE* process) to implement a specific feature.

I'm sure that Microsoft may have implemented this somewhere. I'm thinking about a registry key or something like this.

*OOBE - Out Of Box Experience, this is the process that happens when you boot-up your Windows for the first time and set-up the user, password and computer names.

Diogo

Posted 2011-05-02T13:50:17.050

Reputation: 28 202

Through careful perusal of the event logs you can figure this out, but I don't think it's actually logged specifically someplace...hmm. Hopefully I'm wrong! – Shinrai – 2011-05-02T14:10:08.480

Answers

13

I found the answer.

Find over:

"HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters\BootId" 

The value, in decimal, that you will see is the number of times that your system already rebooted.

Diogo

Posted 2011-05-02T13:50:17.050

Reputation: 28 202

576 times, a veryu interesting question and answer. +1 from me. – Joe Taylor – 2011-07-11T18:22:02.713

17

Each startup and shutdown is recorded in the Event Logs. Open the Event Viewer, and go to the System logs section. If you filter these records (Use the Filter Current Log button on the right) by the Event Numbers 12 and 13, you should just get the events notifying when the system is shutting down and starting up.

Event ID 12 is the system starting up, Event ID 13 is the system shutting down. It also provides the exact time when the event was logged in the event itself.

You could get your application to count the number of events with Event ID 12, which should give you what you want.

Connor W

Posted 2011-05-02T13:50:17.050

Reputation: 3 537

5Good thought, but there are caveats: the event logs can be cleared by a user, and they are limited to a maximum size, so it wouldn't necessarily report the total amount of restarts, especially if it's an old install. – rmart – 2011-05-18T20:59:22.907

@rmart I don't know whether the average user would clean out the Event Logs, but they are both fair points. I think using the S.M.A.R.T. data as mentioned above is probably a better way, but that isn't without it's caveats either. – Connor W – 2011-05-19T10:12:58.537

8

Here's another way : S.M.A.R.T

The vast majority of hard drives these days store SMART information. There are two pieces of informations you might be interested in : 04 Start/Stop Count 12 Power Cycle Count

Check out the wikipedia article on S.M.A.R.T and possibly the documentation of smartmontools.

smartmontools is an open-source project which can query this data in a CLI, or there are other programs around that can get this data with various GUIs : Wikipedia list of SMART tools

camster342

Posted 2011-05-02T13:50:17.050

Reputation: 1 691

I think this is probably a more reliable method than using the Event Viewer, but it has it's caveats also. Unless the drive has been in the same computer from day one, without being changed or used elsewhere, you wont get accurate results. Also, I think older drives don't fully support S..M.A.R.T., so you may find some drives that record power cycle information, and others that don't. – Connor W – 2011-05-19T10:16:18.723

@Connor W : I was guessing that the sort of hard-drives that don't record SMART information were pretty unlikely to be in a machine powerful enough to run Windows 7, but yes, you're entirely right that it can't be relied on. Just like event viewer.... – camster342 – 2011-05-20T01:32:38.803

Also what about if the user uses standby mode or the hard drive turns off due to inactivity? – sinni800 – 2011-06-16T13:18:25.357

@Sinni : Thats what the difference between the 04 code and the 12 code is. 04 is total hard drive spin-ups which would include standbys and powersaving modes. 12 is where the Hard Drive loses power completely, from the PC Shutting down or going into hibernate. – camster342 – 2011-06-17T05:59:20.417

2

Check out the Reliability Manager in Windows 7

uSlackr

Posted 2011-05-02T13:50:17.050

Reputation: 8 755

3This doesn't really tell you when the computer has booted up or shut down though. – Connor W – 2011-05-02T15:33:47.943

1

I've written two short scripts which can count the number of times a computer has turned on.

Unfortunately there isn't an event log for specifically for restarts, only for when the Windows starts up and shuts down.

These script searches the event log for event 12 which is logged when Windows starts. It then tells you how many times it has counted.

VBS Script: Count number of times computer has turned on

count = 0
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'System'" _
& " and EventCode = '12'")
For Each objEvent in colLoggedEvents
count = count + 1
Next
wscript.echo "Number of times operating system has started:   " & count

VBS Script: Remotely count number of times computer has turned on:

count = 0
strComputer=InputBox ("Enter the network name for the remote computer")
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'System'" _
& " and EventCode = '12'")
For Each objEvent in colLoggedEvents
count = count + 1
Next
wscript.echo "Number of times operating system has started:   " & count 

Source VBS Script – Count Number of times computer has turned on

ovann86

Posted 2011-05-02T13:50:17.050

Reputation: 1 106

If this is your website you're linking to (those links you've just updated), please note that you have to disclose your affiliation with it. See http://superuser.com/help/behavior

– slhck – 2014-07-24T11:55:24.087

@slhck - yes, I'm referencing my personal blog. I wasn't aware of those rules. Is there a standard line I should be using to make it clear that I'm referencing content that is also on my personal blog? I posted all answers long ago when I had time, I'm changing domain names and want to update the links before the domain expires. I run my personal blog to record things I need to remember and to share knowledge, hence the cross posting between superuser. – ovann86 – 2014-07-25T11:49:25.430

1Please just be explicit and say, "my blog" or something. As long as you make sure the actual answers are contained here, and people don't have to leave the site to get a solution, it's fine. Adding links for details is always ok. – slhck – 2014-07-25T11:55:40.053