How can I get the Windows last reboot reason

Question

I d like to know what is the Windows API function  if any exists  that provides information about the last Windows reboot source  There are three main possible causes    The computer crashed on a blue screen A user or a program shutdown restarted the computer A power lost   The more details I can get the better  However  I need to know at least which reason it is from the main ones   I need to support Windows Vista and Windows 7   Answer   It seems that there is no direct API to get that information  Instead  we have to harvest the Windows Event Log  System reboot information is located in Event Viewer Windows Logs System  Here is the various information provided by the event ids    6005  Windows start-up 6006  Windows shutdown  properly  6008  Windows shutdown  unexpectedly    I do not yet get the difference between power lost and system crash  but it s a good start

User · Answer

Take a look at the Event Log API  Case a   bluescreen  user cut the power cord or system hang  causes a note   system did not shutdown correctly  or something like that  to be left in the  System  event log the next time the system is rebooted properly  You should be able to access it programmatically using the above API  honestly  I ve never used it but it should work

User · Answer

This article explains in detail how to find the reason for last startup shutdown  In my case  this was due to windows SCCM pushing updates even though I had it disabled locally   Visit the article for full details with pictures   For reference  here are the steps copy pasted from the website         Press the Windows   R keys to open the Run dialog  type eventvwr msc  and press Enter    If prompted by UAC  then click tap on Yes  Windows 7 8  or Continue  Vista     In the left pane of Event Viewer  double click tap on Windows Logs to expand it  click on System to select it  then right click on   System  and click tap on Filter Current Log    Do either step 5 or 6 below for what shutdown events you would like to see    To See the Dates and Times of All User Shut Downs of the Computer      A  In Event sources  click tap on the drop down arrow and  check the USER32 box       B  In the All Event IDs field  type 1074  then click tap on OK       C  This will give you a list of power off  shutdown  and restart   Shutdown Type of events at the top of the middle pane in Event Viewer       D  You can scroll through these listed events to find the events   with power off as the Shutdown Type  You will notice the date and   time  and what user was responsible for shutting down the computer per   power off event listed       E  Go to step 7    To See the Dates and Times of All Unexpected Shut Downs of the Computer      A  In the All Event IDs field  type 6008  then click tap on OK       B  This will give you a list of unexpected shutdown events at the   top of the middle pane in Event Viewer  You can scroll through these   listed events to see the date and time of each one

[windows] How can I get the Windows last reboot reason

Examples related to windows

Examples related to winapi

Examples related to shutdown

Examples related to reboot