gather last reboot events

 function Write-Log {

    param (

        [string]$Message,

        [string]$LogFilePath = "C:\Windows\Logs\Software\LastRebootEvent.log"

    )

    $Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

    $LogMessage = "$Timestamp : $Message"

    

    $LogDir = [System.IO.Path]::GetDirectoryName($LogFilePath)

    if (!(Test-Path -Path $LogDir)) {

        New-Item -ItemType Directory -Path $LogDir -Force

    }


    

    $LogMessage | Out-File -FilePath $LogFilePath -Append -Encoding UTF8

}



Write-Log "Starting to gather last reboot events..."


# Event IDs to filter: 1074 (user/system initiated restart/shutdown), 6005 (system startup), 6006 (clean shutdown), 6008 (unexpected shutdown)

$EventIDs = @(1074, 6005, 6006, 6008)


# Get events from the System log within the last 90 days

$Events = Get-WinEvent -FilterHashtable @{

    LogName   = 'System'

    StartTime = (Get-Date).AddDays(-90)

    ID        = $EventIDs

} | Select-Object TimeCreated, ID, ProviderName, Message


Write-Log "Retrieved $($Events.Count) events from the System log."


foreach ($Event in $Events) {

    $LogEntry = "Event Time: $($Event.TimeCreated), Event ID: $($Event.ID), Provider: $($Event.ProviderName), Message: $($Event.Message)"

    Write-Log $LogEntry

}


Write-Log "Reboot events logging completed."


Comments

Post a Comment

Popular posts from this blog

powershell script to export applications and its requirement in weird way

 $SiteCode = 'DEV' $sccmserver = 'covid-100' $Applications = Get-WmiObject -Namespace "root\SMS\Site_$SiteCode" -Class SMS_Application -ComputerName $SCCMServer foreach ($apps in $Applications){ $DTS = Get-CMDeploymentType -ApplicationName $apps.LocalizedDisplayName foreach ($DT in $DTS){ $req = Get-CMDeploymentTypeRequirement -InputObject $DT "$($apps.LocalizedDisplayName) ; $($req.name)" | Out-File -FilePath "C:\Users\username\Desktop\dtsssss.csv" -Append } }
Read more

get-allrecent udpated logs

 # winrm service should be running on the machine where script is running for ciminstance query else change it to get-wmiobject # Get-Allrecentlogs -computername 'localhost' -startdateandtime '01/01/2005 00:00' -enddateandtime '07/07/2020 00:00' -logfilextension 'flv' # Get-Allrecentlogs -computername 'localhost' -startdateandtime '01/01/2005 00:00' -enddateandtime '07/07/2020 00:00' -logfilextension 'mp4' Function Get-Allrecentlogs{ param([string]$computername = 'localhost', [datetime]$startdateandtime, [datetime]$enddateandtime, [string]$logfilextension = 'log' ) if ($computername -eq 'localhost')     {     $location = (Get-CimInstance -ClassName Win32_logicaldisk -Filter "DriveTYpe = '3'").DeviceId     } else { $shares = Get-CimInstance -ComputerName $computername -ClassName Win32_share | Where-Object {$_.Path -match '^\w{1}:\\$'} [System.Collections.ArrayList]$location ...
Read more

TASK sequence duration report

 SELECT   sys.Netbios_Name0 AS [Machine Name],   sys.User_Name0,   os.Caption0[Operating System],  os.InstallDate0 [OS installed date],  os.BuildNumber0[OS build number],  tsstart.Time as [TS StartTime],   tslast.Time as [TS EndTime],   CASE     WHEN DATEDIFF(dd, tsstart.Time, tslast.Time) > 0 THEN     CAST(DATEDIFF(dd, tsstart.Time, tslast.Time) AS VARCHAR(2)) + 'd '    ELSE ''   END +     convert(char(8),DATEDIFF(MINUTE, tsstart.Time , tslast.Time)) AS [Duration in Minutes] FROM  (   SELECT    MAX(ExecutionTime) AS Time,    AdvertisementID,    ResourceID   FROM v_TaskExecutionStatus  WHERE LastStatusMessageID = 11140 AND Step = 0   GROUP BY AdvertisementID,ResourceID  ) tsstart    INNER JOIN  (   SELECT    AdvertisementID,    Res...
Read more