Powershell to get Windows Startup & Shutdown times

Here’s a quick Powershell snippet to get the startup and shutdown times for a windows system after a specific point.

Get-EventLog -LogName System -ComputerName myHost -After 12/03/2013 -Source "Microsoft-Windows-Kernel-General" | Where-Object { $_.EventId -eq 12 -or $_.EventId -eq 13; } | Select-Object EventId, TimeGenerated, UserName, Source | Sort-Object TimeGenerated | Format-Table -Autosize;

Id 12 indicates a startup event while 13 a shutdown event.

EventID TimeGenerated       UserName            Source
------- -------------       --------            ------
     13 12/03/2013 07:41:58                     Microsoft-Windows-Kernel-General
     12 12/03/2013 07:44:06 NT AUTHORITY\SYSTEM Microsoft-Windows-Kernel-General

Leave a Reply

Current ye@r *