PowerShell Script for Shutdown/Reboot Events Tracker

PowerShell Script for Shutdown/Reboot Events Tracker





Single Server Reboot Report:




  01.   Get
-WinEvent -FilterHashtable @{logname='System'; id=1074}  |
02.  ForEach-Object {
03. 
04.    $rv = New-Object PSObject | Select-Object Date, User, Action, Process, Reason, ReasonCode, Comment
05.    $rv.Date = $_.TimeCreated
06.    $rv.User = $_.Properties[6].Value
07.    $rv.Process = $_.Properties[0].Value
08.    $rv.Action = $_.Properties[4].Value
09.    $rv.Reason = $_.Properties[2].Value
10.    $rv.ReasonCode = $_.Properties[3].Value
11.    $rv.Comment = $_.Properties[5].Value
12.    $rv
13.    
14.  } | Select-Object Date, Action, Reason, User



Multiple Servers Reboot Report:



01.Function Get-ComInfo {
02. 
03.param(
04.## Computers
05.$computers
06. 
07.)
08. 
09."#"*160
10."Server Reboot Report"
11."Generated $(get-date)"
12."Generated from $(gc env:computername)"
13."#"*160
14. 
15.Get-WinEvent -ComputerName $computers -FilterHashtable @{logname='System'; id=1074}  |
16.  ForEach-Object {
17. 
18.    $rv = New-Object PSObject | Select-Object Date, User, Action, Process, Reason, ReasonCode, Comment
19.    $rv.Date = $_.TimeCreated
20.    $rv.User = $_.Properties[6].Value
21.    $rv.Process = $_.Properties[0].Value
22.    $rv.Action = $_.Properties[4].Value
23.    $rv.Reason = $_.Properties[2].Value
24.    $rv.ReasonCode = $_.Properties[3].Value
25.    $rv.Comment = $_.Properties[5].Value
26.    $rv
27.    
28.  } | Select-Object Date, Action, Reason, User
29. 
30.}
31. 
32.Get-Content computers.txt | ForEach-Object { Get-ComInfo -computers $_}


Required powershell 3 & higher.
Function Get-ComInfo { 
   
param( 
## Computers 
$computers 
   
   
"#"*80 
"Server LastBootUpTime-InstallDate-Sl Nos Report" 
"Generated $(get-date)" 
"Generated from $(gc env:computername)" 
"#"*80 
   
Get-CimInstance Win32_OperatingSystem -comp $computers | select  csname,LastBootUpTime
   
   
Get-Content computers.txt | ForEach-Object { Get-ComInfo -computers $_} | 
Out-File -Append Servers_LastBootUpTime.txt

_____________________________________________________________________________________________________________

Regards
Biswajit Biswas
My Blogs|TechnetWiki Ninja

Leave a Comment
  • Please add 2 and 7 and type the answer here:
  • Post
Wiki - Revision Comment List(Revision Comment)
Sort by: Published Date | Most Recent | Most Useful
Comments
  • Richard Mueller edited Revision 15. Comment: Removed tag "w2k8r2", added tags "Has TOC" and "Has Comment"

  • Maheshkumar S Tiwari edited Revision 12. Comment: Added tags and minor edit

  • Balaji M Kundalam edited Revision 11. Comment: Typography - minor correction

Page 1 of 1 (3 items)
Wikis - Comment List
Sort by: Published Date | Most Recent | Most Useful
Posting comments is temporarily disabled until 10:00am PST on Saturday, December 14th. Thank you for your patience.
Comments
  • Pinged back from www.vinithmenon.com/.../powershell-script-to-find-who-restarted.html

  • (shutdown events tracker)

    wmic /output:C:\reboot.htm ntevent where (LogFile='system' and SourceName='user32') get Message, TimeGenerated /format:hform.xsl

  • 1. How to find the particular process details

    Get-Process -Name lsass

    2. Determine a year is LeapYear or not?

    [datetime]::isleapyear(2008)

    3. How to count days?

    $result = [datetime] "06/16/2014" - [DateTime]::Now

    $result.TotalDays

    4. How to take the output from a varriable.

    PS C:\> $name = "Biswajit Biswas"

    PS C:\> Write-Output $name

    Biswajit Biswas

    5.List the Properties and Methods of a WMI Class.

    Get-WmiObject -List -Namespace 'root\CIMV2'

  • Get-EventLog -ComputerName <computer_name> System | Where-Object { $_.Source -eq 'user32' } | ConvertTo-HTML | Out-File C:\Reboot.htm

  • Balaji M Kundalam edited Revision 11. Comment: Typography - minor correction

  • Maheshkumar S Tiwari edited Revision 12. Comment: Added tags and minor edit

  • Richard Mueller edited Revision 15. Comment: Removed tag "w2k8r2", added tags "Has TOC" and "Has Comment"

Page 1 of 1 (7 items)