Skip to main content
Super User

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

7
  • To Windows, there isn't a difference between a reboot and a shutdown, once you log back into your account. Windows knows a reboot happen and knows a shutdown happen, but there is no different when it comes to the logon event
    – Ramhound
    Commented Oct 21, 2018 at 15:14
  • Could compare the time since last shutdown
    – Xen2050
    Commented Oct 21, 2018 at 15:43
  • Hello Ramhound This is a question for the more experienced, and it is also probable to remain unanswered. In any case, what you say is not correct: If you try to restart the machine (and check the time) and the next restart open "Eventviewer" and filters "Windows Logs" -> "System", level "Information", source "USER32", ID 1074 tells you how it was restarted the machine (check the time!).
    – Luciano
    Commented Oct 21, 2018 at 16:03
  • I'll tell you more: if the computer turns off due to a power failure, at the next restart the EMS menu appears where you can choose whether to start the machine in "Safe mode", "Normally", etc. and this implies that this information is stored somewhere in the BCD, it's obvious. Finally, for completeness, I add that in server systems (and only in server systems) in addition to choosing the shutdown mode, you can add a description to the event, which is then stored somewhere in the system (I suppose in a log file), but where exactly?
    – Luciano
    Commented Oct 21, 2018 at 16:04
  • Probably this information can also be found in the register, in the "System" hive, but also here, where?
    – Luciano
    Commented Oct 21, 2018 at 16:05