Sunday, March 25, 2018

Power shell Script to get Server reboot history

Being an Admin we may wanted to get server reboot history.We can get it through event viewer and look for event 1024.But how to filter only the reboot events.This powershell script helps to filter logs from remote system and get the desired output


Get-WinEvent -cn <Computer> -FilterHashtable @{logname='System'; id=1074}  | ForEach-Object {
$ev = New-Object PSObject | Select-Object Date, User, Action, Process, Reason, ReasonCode, Comment
$ev.Date = $_.TimeCreated
$ev.User = $_.Properties[6].Value
$ev.Process = $_.Properties[0].Value
$ev.Action = $_.Properties[4].Value
$ev.Reason = $_.Properties[2].Value
$ev.ReasonCode = $_.Properties[3].Value
$ev.Comment = $_.Properties[5].Value
$ev
} | Select-Object Date, Action, Reason, User





Regards
Bijesh

No comments:

Post a Comment