События стоп/запуск Windows

Event ID 6005 will be labeled as “The event log service was started”. This is synonymous to system startup.
Event ID 6006 will be labeled as “The event log service was stopped”. This is synonymous to system shutdown.