How to find reboot information from Event Logs via Powershell
This little sniplet is very useful to get eyes on reboot data
Get-EventLog System -Newest 10000 | ` Where EventId -in 41,1074,1076,6005,6006,6008,6009,6013 | ` Format-Table TimeGenerated,EventId,UserName,Message -AutoSize -wrap
It generates a nicely formatted table and provides the information. Here is a section of the output:
TimeGenerated EventID UserName Message ------------- ------- -------- ------- 4/11/2023 12:00:00 PM 6013 The system uptime is 280813 seconds. 4/11/2023 11:59:58 AM 6013 The system uptime is 280811 seconds. 4/10/2023 12:00:00 PM 6013 The system uptime is 194412 seconds. 4/10/2023 11:59:58 AM 6013 The system uptime is 194410 seconds. 4/9/2023 12:00:00 PM 6013 The system uptime is 108012 seconds. 4/9/2023 11:59:59 AM 6013 The system uptime is 108011 seconds. 4/8/2023 12:00:00 PM 6013 The system uptime is 21613 seconds. 4/8/2023 11:59:58 AM 6013 The system uptime is 21611 seconds. 4/8/2023 5:59:59 AM 6013 The system uptime is 11 seconds. 4/8/2023 5:59:59 AM 6005 The Event log service was started. 4/8/2023 5:59:59 AM 6009 Microsoft (R) Windows (R) 10.00. 14393 Multiprocessor Free. 4/8/2023 5:59:23 AM 6006 The Event log service was stopped. 4/8/2023 5:59:07 AM 1074 NT AUTHORITY\SYSTEM The process C:\windows\SysWoW64\shutdown.exe (PCNAME) has initiated the restart of computer PCNAME on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found Reason Code: 0x81000000 Shutdown Type: restart Comment: Restarted by Windows Agent
Related Posts
5 lines of code to run Speedtest from Command Line
Posted on 24 October 2023There are instances, where you need to run a Speedtest to check Internet speeds. The speedtest.net website is getting overly crowded with ads and sometimes may not reflect true speeds. I have found an easy way ...
Set passwords to never expire via Command Line on Windows
Posted on 15 May 2023This can be handled in multiple ways. However, I like the one liner using WMI: WMIC USERACCOUNT WHERE Name='username' SET PasswordExpires=FALSE Change username to the account you need to set and you are good to go.
Export Your Rules in Microsoft 365 to a CSV file
Posted on 09 May 2023There are times I needed to export my rules to a human readable form. This comes very handy. If you haven't installed the ExchangeOnline module, you can follow https://learn.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps Open a Powershell window, then: Connect-ExchangeOnline Get-InboxRule -Mailbox user1| ...
Leave a Reply