Not sure I will ever need to use this again, but needed a way to check who last rebooted a server. <\/p>\n
We used this code:<\/p>\n
Note that event ID 1074 gives you if a user requested a Reboot, if the system crashed there will be no 1074 but a 1076 which is the reason given by the first user to login to the machine.<\/p>\n","protected":false},"excerpt":{"rendered":" Not sure I will ever need to use this again, but needed a way to check who last rebooted a server. We used this code: Get-EventLog -logname “system” | where-object {($_.eventid -eq 1074)} | % {if(($_.TimeGenerated).DayOfYear -eq (get-date).DayOfYear){$_.EventID,$_.TimeGenerated,$_.Message}} Note that event ID 1074 gives you if a user requested a… Continue reading
\nGet-EventLog -logname \"system\" | where-object {($_.eventid -eq 1074)} | % {if(($_.TimeGenerated).DayOfYear -eq (get-date).DayOfYear){$_.EventID,$_.TimeGenerated,$_.Message}}
\n<\/code><\/p>\n