Monday, October 24, 2016

Determining whether the system was up at a given time with PowerShell, kind of

There isn't an easy cut-and-dry way of determining whether a Windows machine was running at a given time. You could try to look through Kernel-Power events and try to match "off"-like ones with "on"-like ones, but that would be tricky to get right with all the various power state transitions, especially if you consider sudden power losses.

Instead, I suggest this slightly subjective but very simple PowerShell oneliner:

Get-WinEvent -LogName Application | ? {$_.TimeCreated -le '10/19/2016 12:45 PM'} | select -First 1

It consults the Application event log (one of the very active logs) to get the most recent event before the given time. If that event's time is more than three hours or so before the given time, it's likely that the system was not running. If a human is reading the output, the contents of the most recent event would also probably provide a clue as to whether the system was powering down.

Based on my Super User answer.

No comments:

Post a Comment