Use PowerShell function to get reboot details remotely

In this article you will find useful function which will help you get reboot details from remote machines. Script use Get-WinEvent command to find reboot related log entries. Additionally it also check last reboot time and calculate it’s up time.

Script will collect following information:

– BootUpTime
– UpTime
– RebootDate
– UserName
– Action
– Process
– Reason

Write-Host command has been used for displaying “UpTime” and “BootUpTime” values as its just additional information:

Write-Host "Uptime     : $Uptime"
Write-Host "BootUpTime : $LastBootUpTime`n"

Usage:

Get-RebootDetails -First 5
Get-RebootDetails -First 5 | Out-GridView
Get-RebootDetails -First 10 | Format-Table
Get-RebootDetails -Computername DC01,DC02 -First 20 
Get-RebootDetails -Computername (Get-Content "C:\temp\servers.txt") -First 2 | Out-GridView

Output:

Get-RebootDetails
Get-RebootDetails

Final script:


Function Get-RebootDetails {
    [CmdletBinding()]
              
    # Parameters used in this function
    param
    (
        [Parameter(Position=0, Mandatory = $false, HelpMessage="Provide server names", ValueFromPipeline = $true)] 
        $Computername = $env:computername,
  
        [Parameter(Position=1, Mandatory = $false, HelpMessage="How many events?", ValueFromPipeline = $true)] 
        $First = "1"
    ) 
        $SystemArray = @()
          
        # Looping each server   
        ForEach ($Server in $Computername )
        {
            $Events = $null
            $OS = $null
            $Check = $null

            Write-Host "Processing $Server" -ForegroundColor Green
  
            # Checking if server exist and getting OS details
            Try
            {
                $Check = [System.Net.Dns]::GetHostAddresses($Server) 
                  
                # Get OS details using WMI query
                $OS = Get-WmiObject win32_operatingsystem -ComputerName $Server | Select-Object LastBootUpTime,LocalDateTime,organization,Caption,OSArchitecture 
            }
            Catch
            {
                $TryError1 = $_.Exception.Message
                Write-Warning "$Server - $TryError1"
                Continue
            } 
            
            If($OS)
            {
                # Checking bootup and local time
                $LastBootUpTime = [Management.ManagementDateTimeConverter]::ToDateTime(($OS).LastBootUpTime)
                $LocalDateTime = [Management.ManagementDateTimeConverter]::ToDateTime(($OS).LocalDateTime)
                       
                # Calculate uptime
                $Up = $LocalDateTime - $LastBootUpTime
                $Uptime = "$($Up.Days) days, $($Up.Hours)h, $($Up.Minutes)mins"
 
                Write-Host "Uptime     : $Uptime"
                Write-Host "BootUpTime : $LastBootUpTime`n"
 
                Try
                {
                    # Get events
                    $Events = Get-WinEvent -ComputerName $Server -FilterHashtable @{logname='System'; id=1074} | Select-Object timecreated,properties -First $First
                }
                Catch
                {
                    $TryError2 = $_.Exception.Message
                    Write-Warning "$Server - $TryError2"
                    Continue
                } 
  
                If ($Events) 
                {
                    ForEach($item in $Events)
                    {
                        $Object = New-Object PSObject -Property ([ordered]@{ 
                        
                            Server            = $Server
                            #BootUpTime        = $LastBootUpTime
                            #UpTime            = $Uptime
                            RebootDate        = $Item.timecreated
                            UserName          = $Item.Properties[6].Value
                            Action            = $Item.Properties[4].Value
                            Process           = $Item.Properties[0].Value
                            Reason            = $Item.Properties[2].Value
                      
                        })
  
                        $SystemArray += $Object
                    }
                }
            }
        }
          
        # Results
        If($SystemArray)
        {
            Return $SystemArray
        }
}

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.