The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,426 other followers

PowerShell – query reboot/shutdown events

Posted by jpluimers on 2018/06/19

Thanks [WayBackgbabu for the below PowerShell ide

As PowerShell command:

Get-EventLog System | Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} | ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap

Based on it and my own experience, thse Event IDs can be interesting:

  • 41 – The system has rebooted without cleanly shutting down first
  • 109 – The kernel power manager has initiated a shutdown transition.
  • 1073 – The attempt by user [domain]\[username] to restart/shutdown computer [computername] failed.
  • 1074 – The process [filename].[extension] has initiated the restart of computer [computername] on behalf of user [domain]\[username\ for the
  • 1076 – ???
  • 6008 – The previous system shutdown at [time-in-local-format] on [date-in-local-format] was unexpected.

You can also run this as a batch file, but not you need to escape the pipe | into ^| like this:

PowerShell Get-EventLog System ^| Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} ^| ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap

If you have PowerShell 3.0 or greater, then you can use the [Archive.is-In operator:

PowerShell Get-EventLog System ^| Where-Object {$_.EventID -in "41", "109", "1074", "6008", "1076"} ^| ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap

–jeroen

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

 
%d bloggers like this: