How to see if last boot of Windows 10 was from fast startup, normal shutdown or hibernation

Ever since Windows 8, Windows is able to perform various types of shutdown operations. In addition to the classic hibernation and shutdown operations, Microsoft added a hybrid shutdown called "Fast Startup". The Fast Startup combines the hibernation of the OS kernel with logoff. So it reduces the next boot time by allowing the operating system to start significantly faster yet logs in to a fresh user session. If you are interested in knowing what your last operating system's shutdown type was (fast startup, normal shutdown or hibernation), here is how you can see that information in Windows 10.

If you disabled Fast Startup, then you have only two options - the normal (full) shutdown and hibernation. Unfortunately, sometimes Fast Startup causes issues with drivers, so some devices may not work properly.

To see if the last boot of Windows 10 was from fast startup, normal shutdown or hibernation, you need to do the following:

  1. Open PowerShell.
  2. Type or paste the following command:
    Get-WinEvent -ProviderName Microsoft-Windows-Kernel-boot -MaxEvents 10 | Where-Object {$_.message -like “The boot type*”};

    Press Enter to execute it.

  3. You will get the following output:
    Windows 10 last boot typeFor non-English OS, use the following command (thanks to our reader Tony):
    Get-WinEvent -ProviderName Microsoft-Windows-Kernel-boot -MaxEvents 10 | Where-Object {$ -like “27”};

Take a look at the "Message" column. Its value indicates the type of shutdown from which Windows 10 was started. It is a string which looks like this:

The boot type was <"hexadecimal value">

The hexadecimal value can have one of the following meanings:

  • 0x0 - Windows 10 was started after a full shutdown.
  • 0x1 - Windows 10 was started after a hybrid shutdown.
  • 0x2 - Windows 10 was resumed from hibernation.

That's it.

Support us

Winaero greatly relies on your support. You can help the site keep bringing you interesting and useful content and software by using these options:

If you like this article, please share it using the buttons below. It won't take a lot from you, but it will help us grow. Thanks for your support!


Author: Sergey Tkachenko

Sergey Tkachenko is a software developer who started Winaero back in 2011. On this blog, Sergey is writing about everything connected to Microsoft, Windows and popular software. Follow him on Telegram, Twitter, and YouTube.

4 thoughts on “How to see if last boot of Windows 10 was from fast startup, normal shutdown or hibernation”

  1. Warning!It will NOT work if you have other language, for example Czech. If you are facing this problem, try this command(in Powershell): Get-WinEvent -ProviderName Microsoft-Windows-Kernel-boot -MaxEvents 10 | Where-Object {$ -like “27”}; I think that this is better than translating it. Or you can download the ready-to-use file here: (click on the tick(it displays when howering the file) on Boottype.cmd and click on Download)

Leave a Reply

Your email address will not be published.

Using Telegram? Subscribe to the blog channel!
Hello. Add your message here.