Time and date of last shutdown

Hi

I've been searching for a way to find the date and time that a PC was last shut down correctly. I came across HKLM\System\CurrentControlSet\Control\Windows and a value within it - ShutdownTime. In mine (XP Pro) there is a binary value: 04FB79E2DF9FC701.

I have a couple of questions:

Firstly, there is also a binary value in the same area in ....\ControlSet001\... which is different (84445FE4F17DC701) whilst the value in the same area in ...\ControlSet002\... and ...\ControlSet003\... is the same as that in ...\CurrentControlSet\... Why the different value in ...\ControlSet001\...?

Secondly, I interpreted the first binary value using Decode (http://www.digital-detective.co.uk/freetools/decode.asp) and I was fortunate to use the first Decode Format (Windows: 64 bit Hex Value - Little Endian) which gave me the correct date and time when I last shut down my PC (Sat, 26 May 2007 21:50:32 UTC). Is there any other way that I can decode the binary value? Ideally, I'd like to be able to do it manually so I understand exactly what's happening. I've not been able to find information anywhere about the binary format of date/time in the registry. I've no idea about the other binary value which decodes to Fri, 13 April 2007 17:33:47 UTC. Any ideas?

Thanks for your time (and patience!).

I guess you can ignore it.

Control sets are just records of boot default values, so one is current one used, another is default, another is last known good, and another is last failed.

I think that only 4 are supported?

Friday 13th. well we all know about that?.............. it will be the last failed :D

If you are not having problems I would expect most (apart from fail) to be the same.

;)

Thanks for the prompt reply.

I read about binary date values in the registry being a 64-bit hex value which increments every 0.000001 seconds (I think that's the correct number of zeros!) and the "start" time was around 1 January 1601. I did the calculation for my "real" last shutdown time and it was way, way off. It gave me a date towards the early part of 1715. I guess that the information I read was wrong. Does anyone have correct information about how binary date/time values in the registry are produced?

eh, quickest way is surely event viewer?

Yes, I see what you mean. I looked at the System in Event Viewer and the final entry last night was when the Event log service was stopped at 22:14:45. I checked the binary time value (as in my first post) and it reported the shutdown time as 21:15:06. I can account for the one hour difference (I think) because of British Summer Time (correct?). I assume that the 21 second difference is the process of actually shutting down the system, writing to essential files etc. Is this correct or should I check elsewhere in the Event Viewer? I couldn't see anything else which seemed to relate to when I shut down last night.

Yes, I think that the daylight savings time has something to do with it. You could test this by changing the time zone? I am not sure but maybe the "core" time is GMT, and it offsets from this?

Also reset to GMT and turn daylight savings time adjustment off?

The seconds difference would be the shutdown time IMHO, as I am not aware of more than one CMOS RTC, only "interpretations" of its value.

Good point - I'll change the time zone before I shut down today and check the value again tomorrow.

BTW, I've been doing some further investigating regarding calculating the time and date from the binary value. It increments by 100 nanoseconds from 1600. I guess I'll have to try again, but do the maths by hand, rather than rely on online calculators. That'll take me quite a while!

A trick I learned on this site...

for a whole different issue....this is just for a quick check see how log any NT based system has been running

I use it when the user phones and says I cant print ...blah blah
and you say...have you reboot your machine...

they then get all snarky and say of course I reboot ( which BTW they didnt)
meaning you have to trudge over to the machine ....

Check the system cpu time in task manager...system Idle Process

Can sometimes be quicker then looking through logs

MLF

<LOL> Nice trick!

Only sort of works on my pc :P processor doesn't idle much. Good on an office machine though.

One I often use is look at the LAN status. LAN connected for 13 hours, pc was last turned on 13 hours ago.

You can use PSTools and use psinfo or psloggedon to determine how long the machine has been up or how long a user has been logged on.

Or, maybe use the powershell?

get-wmiobject Win32_OperatingSystem lastbootuptime

Quote:

---

__GENUS : 2
__CLASS : Win32_OperatingSystem
__SUPERCLASS :
__DYNASTY :
__RELPATH :
__PROPERTY_COUNT : 1
__DERIVATION : {}
__SERVER :
__NAMESPACE :
__PATH :
LastBootUpTime : 20070528123000.375000-240

---

That doesn't exactly do the same thing you were looking for... determine the last shutdown.. but it determines at least the last reboot or boot.

If you were to use the following:

get-wmiobject Win32_OperatingSystem LocalDateTime

Quote:

---

__GENUS : 2
__CLASS : Win32_OperatingSystem
__SUPERCLASS :
__DYNASTY :
__RELPATH :
__PROPERTY_COUNT : 1
__DERIVATION : {}
__SERVER :
__NAMESPACE :
__PATH :
LocalDateTime : 20070528215947.031000-240

---

Then you can subtract LastBootUpTime : 20070528123000.375000-240 from LocalDateTime : 20070528215947.031000-240 then you can determine that my computer has been "up" for about 9:29:47 giving you the uptime.

Wait! There's more! :D :drink:

You've already observed that one of the last services to stop before a shutdown/reboot is the eventlog. That happens to be stored in the system log and has an event id of 6006. As far as I know, this service can't be stopped any other way than a shutdown or reboot. (Though, I'm sure it's possible via system privledge elevation or a rootkit of sorts.)

get-eventlog System | where {$_.EventID -eq 6006} | format-list

Quote:

---

Index : 18667
EntryType : Information
EventID : 6006
Message : The Event log service was stopped.
Category : (0)
CategoryNumber : 0
ReplacementStrings : {}
Source : EventLog
TimeGenerated : 5/27/2007 2:28:39 PM
TimeWritten : 5/27/2007 2:28:39 PM
UserName :

---

That coupled with entries in the security log of evenit id 551
(User initiated logoff)

get-eventlog Security | where {$_.EventID -eq 551} | format-list

Quote:

---

Index : 422
EntryType : SuccessAudit
EventID : 551
Message : User initiated logoff:

User Name: user

Domain: DOMAIN

Logon ID: (0x0,0xxxxxx)

Category : Logon/Logoff
CategoryNumber : 2
ReplacementStrings : {user, COMPUTER, (0x0,0xxxxxx)}
Source : Security
TimeGenerated : 5/27/2007 2:28:07 PM
TimeWritten : 5/27/2007 2:28:07 PM
UserName : COMPUTER\user

---

So, from the above entries, we can determine that I logged off my computer around 2:28pm on 5-27-07 and turned it on again around 12:30pm on 5-28-07. This is pretty close if I had to guess. I don't recall the exact time I logged off (shutdown) and turned it on again today... but the above looks pretty damn close.

If you really need to get closer, you can probably use more info from that get-wmiobject Win32_OperatingSystem I posted above. To find out all the info you can query from it use

get-wmiobject Win32_OperatingSystem | get-member

That will list all the stuff you can query.
The following may be useful;

CountryCode
CurrentTimeZone
LastBootUpTime
LocalDateTime
Locale

Actually, I'm not sure those others would be useful at all. The CurrentTimeZone is also listed in the lastbootuptime and localdatetime (240 for me during eastern daylight time). countrycode and local will only give you info on country and what kind of language set they're using. :(

I'd forgotten about the good old Sysinternals tools. Thanks for the reminder.

I have PowerShell but haven't used it (I regret I'm a "collector", just in case I might need XYZ some day!). It's confusing to see that my Security log is empty but the Application and System logs are packed with entries. I've not (knowingly) disabled it from logging things for me. I'm not sure that I can, anyway.

You have to enable security auditing.
It is not enabled by default... who knows why...:rolleyes:

http://netsecurity.about.com/cs/tuto...t/ht040503.htm

Yeeks - that's so logical (hint of sarcasm!) isn't it?

Thanks