Powershell to check Last Reboot on a Windows Server

By | | ,

Not sure I will ever need to use this again, but needed a way to check who last rebooted a server.

We used this code:


Get-EventLog -logname "system" | where-object {($_.eventid -eq 1074)} | % {if(($_.TimeGenerated).DayOfYear -eq (get-date).DayOfYear){$_.EventID,$_.TimeGenerated,$_.Message}}

Note that event ID 1074 gives you if a user requested a Reboot, if the system crashed there will be no 1074 but a 1076 which is the reason given by the first user to login to the machine.

Tagged . Bookmark the permalink.

Comments are closed.