Posted On July 5, 2022

PowerShell: Gather Information About Windows Shutdown Reasons

kimconnect 0 comments
blog.KimConnect.com >> Codes >> PowerShell: Gather Information About Windows Shutdown Reasons

Copy and Paste this to See Result(s):

$computername=$env:computername
$limitEventsCount=40000
$daysSearchLimit=30

function getWindowsShutdownReason{
    param(
        $computername=$env:computername,
        $limitEventsCount=10000,
        $daysSearchLimit=7
    )
    try{
        $events = Get-WinEvent -ComputerName $computername -FilterHashtable @{
            Logname = 'system'
            Id = '1074', '6008'
            StartTime = (Get-Date).AddDays(-$daysSearchLimit)
        } -MaxEvents $limitEventsCount -ErrorAction Stop
        # There are 2 types of shutdown codes (1074 = user initiated; 6008 = abrupt shutdowns)
        foreach ($event in $events) {
            if ($event.Id -eq 1074) {
                [PSCustomObject]@{
                    TimeStamp    = $event.TimeCreated
                    ComputerName = $computername
                    UserName     = $event.Properties.value[6]
                    ShutdownType = $event.Properties.value[4]
                }
            }
            if ($event.Id -eq 6008) {
                [PSCustomObject]@{
                    TimeStamp    = $event.TimeCreated
                    ComputerName = $computername
                    UserName     = $null
                    ShutdownType = 'unexpected shutdown'
                }
            }
        }
    }catch{
        write-warning $_
    }    
}

getWindowsShutdownReason $computername $limitEventsCount $daysSearchLimit

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Post

Disable and Enable Trace Logging for Dynamics CRM

# Set common variables $serverTracingRegistry='Registry::HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\MSCRM' # Enable CRM Tracing Add-PSSnapin Microsoft.Crm.PowerShell $setting = Get-CrmSetting TraceSettings…

Credit_Invoice_Reprints_ZZ6_7_8.bat

fsguiapp.exe -cm:\mfgsys\fs.cfg -iZZ1{TAB}y2k99{CR}bexe{ESC}zz6{CR}M:\cabsauto\timeout 15fsguiapp.exe -cm:\mfgsys\fs.cfg -iZZ2{TAB}y2k99{CR}bexe{ESC}zz7{CR}M:\cabsauto\timeout 15fsguiapp.exe -cm:\mfgsys\fs.cfg -iZZ3{TAB}y2k99{CR}bexe{ESC}zz8{CR}rem M:\cabsauto\timeout 15rem fsguiapp.exe -s -cm:\mfgsys\fs.cfg -iZZ4{TAB}y2k99{CR}bexe{ESC}zz4{CR}

PowerShell: Add System Backup Privileges

function addSystemPrivilege{ param( [String[]]$privileges=@("SeBackupPrivilege","SeRestorePrivilege") ) function includeSystemPrivileges{ $win32api = @' using System; using System.Runtime.InteropServices; namespace…