How can I get the Windows last reboot reason

Question

I'd like to know what is the Windows API function (if any exists) that provides information about the last Windows reboot source. There are three main possible causes:

1. The computer crashed on a blue screen
2. A user or a program shutdown/restarted the computer
3. A power lost

The more details I can get the better. However, I need to know at least which reason it is from the main ones.

I need to support Windows Vista and Windows 7.

Answer:

It seems that there is no direct API to get that information. Instead, we have to harvest the Windows Event Log. System reboot information is located in Event Viewer/Windows Logs/System. Here is the various information provided by the event ids:

• 6005: Windows start-up
• 6006: Windows shutdown (properly)
• 6008: Windows shutdown (unexpectedly)

I do not yet get the difference between power lost and system crash, but it's a good start.

Answer 1

Maybe a question for serverfault.com. Go to the System Tools -> Event Viewer and check there :-)

Answer 2

You can view the Events Log which might help you troubleshoot your problem

Answer 3

Take a look at the Event Log API. Case a) (bluescreen, user cut the power chord or system hang) causes a note ('system did not shutdown correctly' or something like that) to be left in the 'System' event log the next time the system is rebooted properly. You should be able to access it programmatically using the above API (honestly, I've never used it but it should work).