Can WevtUtil find boot & shutdown duration ?

StymiedMike · Mar 12, 2023

Windows 10 Event Viewer has always been sporadic in displaying Event 100 Boot Duration and Event 200 Shutdown Duration.
Sometimes this displays Events 100 & 200 but usually not. Yet it always worked with Windows 7.
Event Viewer > Applications & Services Logs > Microsoft > Windows > Diagnostics-Performance > Operational.

I stumbled across WevtUtil and wondered if it could provide the data.
Where and How to See the Shutdown and Startup Log in Windows 11 and 10? Quick Solution Here.

This has more details.
What is WevtUtil and how do you use it?

I tried modifying some of the command versions but could not get any of them to show Events 100 or 200. I have no idea what I’m doing & am just using trial & error. Maybe WevtUtil can’t access the data. Is there any other method to get the data? I’m presuming if the data is not present in Event Viewer then nothing can display it. But why does Event Viewer provide it sometimes but not other times?

I have tried Startup Timer which gives slightly different times however it does not show shutdown times. What’s interesting is after running it, Event Viewer will show Events 100 and/or 200. And after doing a Restart, Event Viewer usually brings up both of these but only one time.
Startup Timer

Is there any known solution to get Event Viewer to reliably show these two Events or perhaps a command line?
Thanks

xrobwx71 · Mar 12, 2023

Is your Win 10 up to date?

Open a command prompt and type winver then Enter and post the result.

I remember a few versions ago (20H2 maybe) MS had taken this out but had reportedly put it back in later versions.

Event ID 100 (Boot Performance Monitoring) not being logged each time a computer is started

Windows boot history and boot performance, explored in Powershell - System Administration

StymiedMike · Mar 13, 2023

I have version 22H2, Build 19045.2604.
Once in while it does display Events 100 and/or 200, but it is pretty rare. The function must be in there but not working most of the time.

As mentioned, after I run Startup Timer then Event Viewer will show 100 or 200. Doing a Windows restart will get it show both events, but only for that one occurrence. At least that's how it's been the few times I've tried it. Startup Timer must be doing something to kick start Event Viewer to log or display those two events.

Thanks for the links. I'll have spend some time & read the second one thoroughly.

xrobwx71 · Mar 13, 2023

100 are startup events and 200 are shutdown events.

If I understand what I read at MS Technet, it will only show when there is a problem during either. Something that is out of set parameters. If these Startup/Shutdown Events are within parameters, it won't flag.

Also, see here: https://social.technet.microsoft.co...t-id-100-windows-diagnostics-performance.aspx

From here, all 100 means is Windows started and 200 means Windows shutdown.

https://social.technet.microsoft.co...t-id-200-windows-diagnostics-performance.aspx

StymiedMike · Mar 23, 2023

The Event 100 just shows the boot duration. If there was a problem I'll get another Event listed such as 101 which would explain why the boot took so long. IOW both Events would show up with the same time stamp.

xrobwx71 · Mar 23, 2023

StymiedMike said:
The Event 100 just shows the boot duration. If there was a problem I'll get another Event listed such as 101 which would explain why the boot took so long. IOW both Events would show up with the same time stamp.

Yes

Search

Search

Can WevtUtil find boot & shutdown duration ?

StymiedMike

Well-known member

xrobwx71

Administrator

StymiedMike

Well-known member

xrobwx71

Administrator

StymiedMike

Well-known member

xrobwx71

Administrator