MyITGuy
5/23/2014 - 4:55 PM

PowerShell: Show reboot history.

PowerShell: Show reboot history.

$FilterXml = @'
<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">
       *[System[(EventID=6005)]]
    </Select>
  </Query>
</QueryList>
'@

Get-WinEvent -ComputerName $ComputerName -FilterXml $FilterXml
Get-EventLog -LogName System | Where-Object {$_.EventID -eq 6005}

Get-WinEvent -LogName System | Where-Object {$_.Id -eq 6005}

Get-WinEvent -LogName System -ComputerName (Read-Host "ComputerName") | Where-Object {$_.Id -eq 6005}

# Last Boot Up Time
Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty LastBootUpTime

Get-CimInstance -ClassName Win32_OperatingSystem -Property LastBootUpTime -ComputerName (Read-Host "ComputerName") | Select-Object -ExpandProperty LastBootUpTime
Get-WinEvent -FilterXml '<QueryList><Query Id="0" Path="System"><Select Path="System">*[System[(EventID=6011)]]</Select></Query></QueryList>' -ErrorAction SilentlyContinue | ForEach-Object { $TimeCreated = $_.TimeCreated; if ($_.Message -match "(?<=from )(?'From'.*) to (?'To'.*)\.$") { [PSCustomObject][Ordered]@{TimeCreated=$TimeCreated; From=$Matches.From; To=$Matches.To} }}