Where Windows stores restart records

Windows keeps a record of every time your computer restarts, and you can view this history using the Event Viewer — a built-in tool that logs system events. The restart records are stored in the System log, which tracks hardware and software changes, errors, and shutdowns. You do not need any special software or administrator permissions beyond what you already have on your own machine.

The Event Viewer is the most reliable way to see restart history because it records the exact date and time of each restart, what caused it, and whether it was a planned shutdown or an unexpected crash. This information can help you spot patterns — for example, if your PC restarts every night at the same time, or if restarts spike after you install certain software.

Key Takeaways

  • Open Event Viewer by typing "Event Viewer" into the Windows search box, then navigate to Windows Logs and select System.
  • Look for events with the ID 1074 (planned restart) or 6008 (unexpected shutdown) to find your restart history.
  • The Details tab shows the exact time of the restart and sometimes the reason — such as a Windows update or a specific process.
  • You can filter the System log to show only restart events from the last week or month, which makes it easier to spot patterns.
  • If Event Viewer shows frequent unexpected restarts, check Windows Update settings and run a malware scan to rule out common causes.

Opening Event Viewer and finding the System log

Press the Windows key on your keyboard and type "Event Viewer" into the search box. Click on the Event Viewer result — it will open a window with a folder tree on the left side. You will see a folder called "Windows Logs" with several subfolders underneath it.

Click on the "System" folder under Windows Logs. This folder contains all the restart and shutdown events for your PC. The main panel will fill with a long list of events, each with a date, time, and event ID number. Do not be alarmed by the length of the list — Windows logs thousands of events, but you can filter it to show only restarts.

Filtering for restart events only

In the right-hand panel, you will see an option that says "Filter Current Log". Click on it. A dialog box will open with several fields you can fill in. In the "Event ID" field, type 1074 and click OK. This will show only planned restarts — the ones Windows initiated on purpose, usually because of updates or a shutdown command you gave.

If you want to see unexpected restarts and crashes as well, run the filter again but use event ID 6008 instead. This ID marks sudden shutdowns where Windows did not shut down cleanly. You can run the filter twice and look at both lists, or you can clear the filter and scroll through the full System log manually if you prefer to see everything at once.

Reading the restart details

Each event in the list shows a date, time, and source. Click on any restart event to see more information in the panel below. The "General" tab shows a summary, but the Details tab contains the most useful information — it will tell you why the restart happened, which process or service triggered it, and sometimes which Windows update was being installed.

For example, an event might say "The system has rebooted without cleanly shutting down first. This error could be caused by the system stopping unexpectedly or a buggy driver." Another might say "Windows Update initiated a restart to complete an installation." The Details tab is where you find these explanations, so click on it whenever you want to understand what caused a specific restart.

Checking restart history over a specific time period

If you want to see restarts from only the last week or the last month, use the Filter dialog again. In the "Logged" section at the top, check the box next to "Last 7 days" or "Last 30 days" depending on how far back you want to look. Then add your event ID filter (1074 or 6008) and click OK. Windows will show you only the restarts that happened in that time window.

This is useful if you are trying to figure out when a problem started. For instance, if your PC began restarting unexpectedly three weeks ago, filtering for the last 30 days will show you the exact date the problem began and whether the restarts follow a pattern.

What to do if you see frequent unexpected restarts

If the System log shows many events with ID 6008 (unexpected shutdown), your PC is crashing rather than shutting down cleanly. This can happen because of driver problems, overheating, malware, or failing hardware. Start by checking Windows Update — go to Settings, then Update & Security, and make sure all updates are installed. Restart your PC after updates finish.

Next, run a malware scan using Windows Defender (built into Windows) or a third-party scanner like Malwarebytes. Malware can cause random restarts. If the restarts continue after updates and a clean malware scan, check your PC's temperature using a free tool like HWiNFO or Core Temp — if your CPU or GPU is running above 80°C, overheating is likely the cause and you may need to clean dust from your fans or replace thermal paste. If temperatures are normal and malware is ruled out, the problem may be a failing hard drive or a faulty driver, and you should consider taking your PC to a technician.

Using the command line for a quick restart history

If you prefer not to open Event Viewer, you can see a quick summary of recent restarts using the command line. Press Windows key + R, type cmd, and press Enter. In the black command window, type systeminfo and press Enter. Scroll down to find "System Boot Time" — this shows when your PC last started. It does not show the full history, but it tells you how long your PC has been running since the last restart.

For a more detailed command-line history, type wevtutil qe System "/q:*[System[EventID=1074 or EventID=6008]]" /f:text and press Enter. This will list all restart events in text format. The command line method is faster if you just want a quick look, but Event Viewer gives you much more detail and is easier to read.

Frequently Asked Questions

How far back does Windows keep restart history?

Windows keeps restart records in the System log for as long as the log file has space. By default, the System log can hold about 20 MB of data, which is usually several months of events on a typical PC. Once the log fills up, the oldest events are deleted. You can increase the log size in Event Viewer by right-clicking System, selecting Properties, and changing the "Maximum log size" field.

Why does my restart history show events I do not remember?

Windows logs restarts that happen in the background, including automatic updates you may not have noticed. Some software also triggers restarts without asking permission first. If you see restarts you did not authorize, check the Details tab to see which process or service caused it, then decide whether to uninstall that software or change its settings.

Can I delete my restart history?

Yes. In Event Viewer, right-click the System log and select "Clear Log". This will erase all restart records. However, there is usually no reason to do this unless you are troubleshooting and want a clean slate to watch for new problems. Once you clear the log, you lose the history, so only do this if you have already written down any important information.

What does event ID 1074 mean versus 6008?

Event ID 1074 is a planned restart — Windows shut down cleanly and then restarted. Event ID 6008 means the PC shut down unexpectedly without going through the normal shutdown process, usually because of a crash, power loss, or forced restart. If you see mostly 1074 events, your restarts are normal. If you see many 6008 events, something is causing your PC to crash.

Can I see which program caused a restart?

Sometimes. Click on a restart event and go to the Details tab. Look for fields labeled "Image" or "process Name" — these will tell you which program or service triggered the restart. Not every restart event includes this information, especially if Windows Update or a system service caused it, but many do.