How to see if last boot of Windows 10 was from fast startup, normal shutdown or hibernation

Ever since Windows 8, Windows is able to perform various types of shutdown operations. In addition to the classic hibernation and shutdown operations, Microsoft added a hybrid shutdown called "Fast Startup". The Fast Startup combines the hibernation of the OS kernel with logoff. So it reduces the next boot time by allowing the operating system to start significantly faster yet logs in to a fresh user session. If you are interested in knowing what your last operating system's shutdown type was (fast startup, normal shutdown or hibernation), here is how you can see that information in Windows 10.

If you disabled Fast Startup, then you have only two options - the normal (full) shutdown and hibernation. Unfortunately, sometimes Fast Startup causes issues with drivers, so some devices may not work properly.

To see if the last boot of Windows 10 was from fast startup, normal shutdown or hibernation, you need to do the following:

  1. Open PowerShell.
  2. Type or paste the following command:
    Get-WinEvent -ProviderName Microsoft-Windows-Kernel-boot -MaxEvents 10 | Where-Object {$_.message -like “The boot type*”};

    Press Enter to execute it.

  3. You will get the following output:
    Windows 10 last boot typeFor non-English OS, use the following command (thanks to our reader Tony):

    Get-WinEvent -ProviderName Microsoft-Windows-Kernel-boot -MaxEvents 10 | Where-Object {$ -like “27”};

Take a look at the "Message" column. Its value indicates the type of shutdown from which Windows 10 was started. It is a string which looks like this:

The boot type was <"hexadecimal value">

The hexadecimal value can have one of the following meanings:

  • 0x0 - Windows 10 was started after a full shutdown.
  • 0x1 - Windows 10 was started after a hybrid shutdown.
  • 0x2 - Windows 10 was resumed from hibernation.

That's it.


4 thoughts on “How to see if last boot of Windows 10 was from fast startup, normal shutdown or hibernation

  1. Tony

    Warning!It will NOT work if you have other language, for example Czech. If you are facing this problem, try this command(in Powershell): Get-WinEvent -ProviderName Microsoft-Windows-Kernel-boot -MaxEvents 10 | Where-Object {$ -like “27”}; I think that this is better than translating it. Or you can download the ready-to-use file here: (click on the tick(it displays when howering the file) on Boottype.cmd and click on Download)

    1. Sergey Tkachenko Post author

      Thanks, worth to mention it in the article.

  2. throkr

    Thanks for the article, thanks to Tony : the posted command works perfectly in French too …..

  3. Vijay Patel

    Its Always Show me 0x1 Even I Shut It Down Correctly. Plz Reply Me what the Reason And also a solution..!!


Leave a Reply

Your email address will not be published. Required fields are marked *