Thanks [WayBack] gbabu for the below PowerShell ide
As PowerShell command:
Get-EventLog System | Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} | ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap
Based on it and my own experience, thse Event IDs can be interesting:
- 41 – The system has rebooted without cleanly shutting down first
- 109 – The kernel power manager has initiated a shutdown transition.
- 1073 – The attempt by user [domain]\[username] to restart/shutdown computer [computername] failed.
- 1074 – The process [filename].[extension] has initiated the restart of computer [computername] on behalf of user [domain]\[username\ for the
- 1076 – ???
- 6008 – The previous system shutdown at [time-in-local-format] on [date-in-local-format] was unexpected.
You can also run this as a batch file, but not you need to escape the pipe | into ^| like this:
PowerShell Get-EventLog System ^| Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} ^| ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap
If you have PowerShell 3.0 or greater, then you can use the [Archive.is] -In operator:
PowerShell Get-EventLog System ^| Where-Object {$_.EventID -in "41", "109", "1074", "6008", "1076"} ^| ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap
–jeroen
