How to Event Log Login and Shutdown Activities in Windows 10/8/7 

How to Event Log Login and Shutdown Activities in Windows 10/8/7.
There are times when a user wants to know the startup and shutdown history of a computer. Mostly, system administrators need to know about the history for troubleshooting purposes. If multiple people use the computer, it may be a good security measure to check PC startup and shutdown times to make sure the PC is being used legitimately. In this tutorial we will discuss two ways to keep track of your PC shutdown and startup times.
If you are curious to know why your computer shut down and what happened exactly during the shut down, you will be happy to know that Windows is able to track the shut down process and write a number of events in the system log. In this tutorial, we will see how to find them.
As the OS is using the default log format, all the events related to the shut down can be viewed with the built-in Event Viewer tool. No other third-party tools are required.
In Windows 10, there are three events connected with shut down and restart.
Event ID 1074 - Indicates that the shut down process was initiated by an app. For example, it can be Windows Update.
Event ID 6006 - The clean shut down event. This means Windows 10 was turned off correctly.
Event ID 6008 - Indicates a dirty/improper shutdown. Appears in the log when the previous shutdown was unexpected, e.g. due to power loss or BSoD (Bug check).
Windows Event Viewer is a wonderful tool which saves all kinds of stuff that is happening in the computer. During each event, the event viewer logs an entry. The event viewer is handled by eventlog service that cannot be stopped or disabled manually, as it is a Windows core service. The event viewer also logs the start and stop times of the eventlog service. We can make use of those times to get an idea of when our computer was started or shut down.
The eventlog service events are logged with two event codes. The event ID 6005 indicates that the eventlog service was started, and the event ID 6009 indicates that the eventlog services were stopped. Let’s go through the complete process of extracting this information from the event viewer.
This tutorial will apply for computers, laptops, desktops,and tablets running the Windows 10, Windows 8/8.1, Windows 7 operating systems.Works for all major computer manufactures (Dell, HP, Acer, Asus, Toshiba, Lenovo, Samsung).