-
-
Notifications
You must be signed in to change notification settings - Fork 18
/
Get-Reboots.ps1
86 lines (70 loc) · 2.35 KB
/
Get-Reboots.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
<#
.SYNOPSIS
List events related to system reboots.
.PARAMETER Uptime
Include uptime events in report; default is to hide these
#>
# CmdletBinding adds -Verbose functionality, SupportsShouldProcess adds -WhatIf
[CmdletBinding(SupportsShouldProcess=$true)]
param([switch] $Uptime)
Begin
{
}
Process
{
$ids = (41,1074,1076,6005,6006,6008,6009)
if ($Uptime) {
$ids += (6013)
}
$esc = [char]27
$color = ''
Get-EventLog System -Newest 10000 | `
Where EventId -in $ids | `
Sort-Object -Property TimeGenerated | `
Format-Table `
TimeGenerated,
EventId,
UserName,
@{
Label = 'Message'
Expression =
{
# use 'Get-Colors -all' command to fine DOS [esc color numbers
switch ($_.EventId)
{
#41 { $color = '31'; break } # dark red
#1074 { $color = '33'; break } # dark yellow
#1076 { $color = '33'; break } # dark yellow
6005 { $color = '94'; break } # blue
6006 { $color = '31'; break } # dark red
6008 { $color = '91'; break } # red
6009 { $color = '34'; break } # dark blue
6013 { $color = '90'; break } # dark gray
default { $color = '37' } # normal white
}
"$esc[$color`m$($_.Message)$esc[0m"
}
}`
-AutoSize -Wrap
}
<#
Search for events here: https://kb.eventtracker.com/
41
The time service has been configured to use one or more input providers. However, none of the
input providers is still running. The time service has no source of accurate time.
1074
The process %1 has initiated the %5 of computer %2 on behalf of user %7 for the following reason: %3
1076
The reason supplied by user %6 for the last unexpected shutdown of this computer
is: %1 Reason Code: %2 Bug ID: %3 Bugcheck String: %4 Comment: %5
6005
The Event log service was started.
6006
The Event log service was stopped.
6008
The previous system shutdown at %1 on %2 was unexpected.
6009
Microsoft (R) Windows 2000 (R) <version> Service Pack <number> Uniprocessor Free.
6013
The system uptime is <number> seconds.
#>