How do you check how long it has been since your PC was restarted?

Press Ctrl + Shift + Esc to open Task Manager, go to Performance, select CPU, and read the "Up time" figure. It takes about fifteen seconds. On any Windows PC with Fast Startup enabled, which is the default, that number can be misleading: shutting down and powering back on hibernates the core of Windows to a file on disk rather than clearing it, so the counter keeps running. Blue Arc IT Solutions checks the Kernel-Boot event log when the answer has to be exact.

Three ways to check, fastest first

Task Manager: Ctrl + Shift + Esc, then Performance, then CPU. "Up time" appears at the bottom right as days, hours, minutes and seconds. This is the one to give a staff member over the phone.

PowerShell: run (Get-CimInstance Win32_OperatingSystem).LastBootUpTime and you get the recorded boot timestamp as a date and time. Useful when you want an actual time rather than a duration, and it is the value most monitoring tools read.

Command line: net statistics workstation prints a "Statistics since" line. Treat it as an approximation, because it reports when the Workstation service started rather than a true measure of how long Windows has been running. It usually tracks boot closely, and occasionally does not.

Why the number can lie to you

Fast Startup is switched on by default on any Windows PC capable of hibernation. When someone shuts down, Windows closes all programs and signs everyone out, then saves the core of Windows and its loaded hardware drivers into a file on the disk called hiberfil.sys, and powers off. Microsoft's own wording is unambiguous: "During Fast Startup, the kernel session is not closed, but it is hibernated." Because that core of Windows was never actually shut down, the clock measuring how long it has been running is not reset when the machine comes back.

The practical consequence catches out technicians as often as users. A staff member who dutifully powers their laptop off every evening can still show ten days of uptime, and be entirely honest about switching it off. Task Manager and Win32_OperatingSystem both read from the same boot timestamp, so neither of them will separate the two cases for you. Restarting does reset it, because a restart always performs a full boot cycle: as Microsoft puts it: "The Fast Startup setting doesn't apply to Restart." See our guide to the difference between a restart and a shutdown for the full mechanism.

The definitive check: what kind of boot was it?

This section is for whoever looks after the computers rather than the person using one. Windows logs a Kernel-Boot event, event ID 27, on every start, and it records the boot type. The values are 0x0 for a cold boot, meaning a full shutdown or a restart; 0x1 for a hybrid boot, meaning fast startup; and 0x2 for a resume from hibernation. That distinction is the thing no uptime counter will tell you.

To read it, run this in PowerShell: Get-WinEvent -ProviderName Microsoft-Windows-Kernel-Boot -MaxEvents 50 | Where-Object { $_.Id -eq 27 } | Select-Object TimeCreated, Message. You get a dated list of every boot and what kind each one was. Microsoft does not publish a reference page defining these three values, so treat them as an observed convention rather than a documented contract, but they are consistent and easy to confirm on any machine: restart once, shut down and power on once, then compare the two events.

Event Viewer shows the same thing without PowerShell, under Applications and Services Logs, Microsoft, Windows, Kernel-Boot, Operational.

What a healthy figure looks like

There is no official number, so here is ours. A workstation restarted within the last seven days is fine. Past about two weeks it is usually carrying pending updates, leaked memory in long-running processes, and driver state that has been through however many dock connections, sleep cycles and network changes since the last real boot. Past a month, a restart is worth doing before anyone spends time diagnosing anything. Servers are a separate conversation, governed by a maintenance window rather than a habit.

What counts as an unusual figure now depends on licensing, which is worth knowing before you read too much into a number. On Windows 11 Enterprise version 24H2 or later, hotpatch updates install security patches without a restart and Microsoft enables them by default for all eligible devices in Intune, so only four baseline months a year force a reboot: January, April, July and October. On those fleets, several weeks of uptime can be perfectly normal rather than a sign of neglect. Microsoft 365 Business Premium grants Windows 11 Business upgrade rights rather than Enterprise, so those devices are offered the standard cumulative update instead and still get a restart-requiring patch most months, which means a multi-week uptime figure there is more likely to indicate deferred updates. Business Premium is listed among the licences eligible for hotpatch even though the edition requirement is a separate test, so check the hotpatch quality updates report in Intune rather than assuming either way. See Microsoft Learn on hotpatch with Windows quality updates.

Why the service desk asks

"Have you restarted?" is not a brush-off, it is a request for data. Knowing the machine restarted twenty minutes ago and the fault survived it eliminates an entire branch of the diagnostic tree, and points at configuration, hardware, an account or something at the far end of the network rather than transient state. Knowing the uptime is twenty-three days points straight back at the machine.

The most useful thing you can tell us is both halves: the uptime figure, and whether the last boot was a restart or a power-on from shutdown. On a fleet we manage, restart and update compliance is visible centrally, which is how the machine that has not had a real boot since April gets found before its user logs a ticket about it.

How Blue Arc IT Solutions helps

Blue Arc IT Solutions has supported Australian businesses since 2004, delivering nationally from Canberra. Our latest client survey recorded 96 per cent satisfaction with response time, 94 per cent with resolution and 97 per cent overall. Patching, update and restart policy is something we configure centrally through Microsoft Intune rather than leaving to individual users. See the Windows self-help overview, our managed services, or get in touch.

Last reviewed: 24 August 2026, against Microsoft Learn documentation on Fast Startup and hotpatch updates.

Frequently asked questions

Why does Task Manager show weeks of uptime when I shut down every night?

Because Fast Startup means a shutdown hibernates the core of Windows to a file on disk instead of shutting it down, so the recorded boot time is not reset when you power the machine back on. The counter keeps running across every shutdown and power on. Only a restart, or a genuine full shutdown, resets it.

Does shutting down reset the uptime counter?

Usually not. On a PC with Fast Startup enabled, which is the default on any machine capable of hibernation, the uptime figure in Task Manager and the LastBootUpTime value in Windows both survive a shutdown and power on. A restart resets them, because a restart always performs a full boot cycle.

How often should a Windows PC be restarted?

Blue Arc IT Solutions suggests at least weekly for a workstation, and always before logging a support ticket. Past about two weeks a machine is usually carrying pending updates, leaked memory and driver state that has been through many dock, sleep and network transitions.