PowerShell – query reboot/shutdown events
Posted by jpluimers on 2018/06/19
Thanks [WayBack] gbabu for the below PowerShell ide
As PowerShell command:
Get-EventLog System | Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} | ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap
Based on it and my own experience, thse Event IDs can be interesting:
- 41 – The system has rebooted without cleanly shutting down first
- 109 – The kernel power manager has initiated a shutdown transition.
- 1073 – The attempt by user [domain]\[username] to restart/shutdown computer [computername] failed.
- 1074 – The process [filename].[extension] has initiated the restart of computer [computername] on behalf of user [domain]\[username\ for the
- 1076 – ???
- 6008 – The previous system shutdown at [time-in-local-format] on [date-in-local-format] was unexpected.
You can also run this as a batch file, but not you need to escape the pipe | into ^| like this:
PowerShell Get-EventLog System ^| Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} ^| ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap
If you have PowerShell 3.0 or greater, then you can use the [Archive.is] -In operator:
PowerShell Get-EventLog System ^| Where-Object {$_.EventID -in "41", "109", "1074", "6008", "1076"} ^| ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap
–jeroen
- Source: [WayBack] eventviewer – View Shutdown Event Tracker logs under Windows Server 2008 R2 – Server Fault :: https://serverfault.com/questions/204417/view-shutdown-event-tracker-logs-under-windows-server-2008-r2cmd
- [WayBack] Useful Operational Insights Search Query Collection | musc@> $daniele.work.ToString() “Corporate” Blog of Daniele Muscetta, Premier Field Engineer.
- Event log IDs lists via [WayBack] List of all Windows 7 Event IDs and Sources? – Super User:
- [WayBack] Windows Security Log Encyclopedia
- [WayBack] Troubleshooting Microsoft Windows Event Logs
- [WayBack] Events and Errors isn’t a list nor searchable any more nor is [WayBack] Events and Errors
The Wiert Corner - irregular stream of stuff 
Leave a comment