Being an Admin we may wanted to get server reboot history.We can get it through event viewer and look for event 1024.But how to filter only the reboot events.This powershell script helps to filter logs from remote system and get the desired output
Get-WinEvent -cn <Computer> -FilterHashtable @{logname='System'; id=1074} | ForEach-Object {
$ev = New-Object PSObject | Select-Object Date, User, Action, Process, Reason, ReasonCode, Comment
$ev.Date = $_.TimeCreated
$ev.User = $_.Properties[6].Value
$ev.Process = $_.Properties[0].Value
$ev.Action = $_.Properties[4].Value
$ev.Reason = $_.Properties[2].Value
$ev.ReasonCode = $_.Properties[3].Value
$ev.Comment = $_.Properties[5].Value
$ev
} | Select-Object Date, Action, Reason, User
Regards
Bijesh
Get-WinEvent -cn <Computer> -FilterHashtable @{logname='System'; id=1074} | ForEach-Object {
$ev = New-Object PSObject | Select-Object Date, User, Action, Process, Reason, ReasonCode, Comment
$ev.Date = $_.TimeCreated
$ev.User = $_.Properties[6].Value
$ev.Process = $_.Properties[0].Value
$ev.Action = $_.Properties[4].Value
$ev.Reason = $_.Properties[2].Value
$ev.ReasonCode = $_.Properties[3].Value
$ev.Comment = $_.Properties[5].Value
$ev
} | Select-Object Date, Action, Reason, User
Regards
Bijesh
No comments:
Post a Comment