The first log and last log written in EventLog when the machine was powered on and shut down were: 6005 and 6006.
timecreated Id leveldisplayname message
----------- -------------------------
8/18/2014 9:23:04 AM 6005 Information The Event Log service was started
8/ 15/2014 7:03:48 PM 6006 Information the Event Log service was stopped.
So according to the above information it is easy to get the machine boot, shutdown, online time, code for:
Function get-computeruptimehistory {
$q = '
<QueryList>
<query id= ' 0 ' path= ' System ' >
<select path= "System" >*[system[(eventid=6005 or eventid=6006)]]</select>
</Query>
</ Querylist> '
$events = get-winevent-filterxml $q
$i =-1 while
($i +1-lt $events. Length) {
if ($i-eq- 1
{
[pscustomobject]@{
starttime = $events [0]. timecreated;
StopTime = $null;
UpTime = [datetime]::now-$events [0]. Timecreated
}
}
else{
[pscustomobject]@{
starttime = $events [$i +1]. timecreated;
StopTime = $events [$i]. timecreated;
UpTime = $events [$i]. timecreated-$events [$i +1]. Timecreated
}
}
$i + +
2}
}
The output is:
Ps> Get-computeruptimehistory | Ft-autosize starttime stoptime UpTime-----------------------8/18/2014 9:23:04 AM 2.05:00:22.5891685 8/13/2014 9:30:42 AM 8/15/2014 7:03:48 pm 2.09:33:06 7/22/2014 12:16:09 pm 8/13/2014 9:29:09 AM 21.21:1 3:00 7/22/2014 9:23:08 AM 7/22/2014 11:26:08 am 02:03:00 7/17/2014 11:08:57 am 7/21/2014 6:20:28 PM 4.07:11:31 7/14/2014 9 : 35:11 AM 7/17/2014 11:07:25 AM 3.01:32:14 7/10/2014 3:01:53 pm 7/14/2014 9:21:48 AM 3.18:19:55 7/8/2014 pm 5:04:02 2014 2:58:36 pm 1.21:54:34 6/30/2014 9:17:28 am 7/8/2014 5:01:24 pm 8.07:43:56 6/29/2014 10:24:50 am 6/29/2014 6:04:09 pm 07:39:19 6/20/2014 9:33:08 AM 6/27/2014 6:18:34 pm 7.08:45:26 6/16/2014 3:05:45 pm 6/20/2014 9:31:16 AM 3.18:25:31 6/12/2 014 9:40:05 AM 6/16/2014 3:04:02 pm 4.05:23:57 6/6/2014 2:52:11 PM 6/12/2014 9:37:46 am 5.18:45:35 6/5/2014 10:55:20 am 6 /6/2014 2:51:09 pm 1.03:55:49 6/5/2014 9:19:38 am 6/5/2014 10:54:04 am 01:34:26 6/3/2014 pm 1:33:244 7:58:58 pm 1.06:25:34 5/30/2014 10:07:06 AM 6/3/2014 1:31:24 pm 4.03:24:18 5/29/2014 5:30:33 PM 5/30/2014 9:41:41 AM 1 6:11:08 5/29/2014 5:28:57 pm 5/29/2014 5:29:43 pm 00:00:46 5/29/2014 2:52:58 pm 5/29/2014 5:26:57 pm 02:33:59 5/29/2014 2: 50:31 pm 5/29/2014 2:51:06 pm 00:00:35 5/27/2014 11:54:43 AM 5/29/2014 2:47:29 pm 2.02:52:46 5/23/2014 5:31:18 pm 5/26/201 4 9:16:33 AM 2.15:45:15 5/22/2014 6:00:29 pm 5/23/2014 9:16:45 AM 15:16:16 5/21/2014 4:38:22 pm 5/21/2014 4:40:07 pm 00:01 : 5/21/2014 9:43:59 AM 5/21/2014 4:36:34 PM 06:52:35 5/19/2014 11:27:28 AM 5/21/2014 9:42:32 AM 1.22:15:04 5/19/2014 9:2 5:56 am 5/19/2014 9:27:00 am 00:01:04 5/15/2014 9:23:15 am 5/15/2014 9:24:16 AM 00:01:01 5/15/2014 11:18:45 am 5/15/2014 1
1:19:49 AM 00:01:04