Powershell to get Windows Startup & Shutdown times
Here's a quick Powershell snippet to get the startup and shutdown times for a windows system after a specific point.
Get-EventLog -LogName System -ComputerName myHost -After 12/03/2013 -Source "Microsoft-Windows-Kernel-General" | Where-Object { $_.EventId -eq 12 -or $_.EventId -eq 13; } | Select-Object EventId, TimeGenerated, UserName, Source | Sort-Object TimeGenerated | Format-Table -Autosize;
Id 12 indicates a startup event while 13 a shutdown event.
EventID TimeGenerated UserName Source ------- ------------- -------- ------ 13 12/03/2013 07:41:58 Microsoft-Windows-Kernel-General 12 12/03/2013 07:44:06 NT AUTHORITY\SYSTEM Microsoft-Windows-Kernel-General