Script PowerShell Rastrear Desligamento/Reinicialização Windows - Reboot

Script PowerShell para verificar qual o dia e horário que o servidor foi reiniciado e por qual usuário

Acessar o servidor, abrir o PS, colar este script e dar um enter:

#inicio

Get-WinEvent -FilterHashtable @{logname='System'; id=1074} | ForEach-Object {

$rv = New-Object PSObject | Select-Object Date, User, Action, Process, Reason, ReasonCode, Comment

$rv.Date = $_.TimeCreated

$rv.User = $_.Properties[6].Value

$rv.Process = $_.Properties[0].Value

$rv.Action = $_.Properties[4].Value

$rv.Reason = $_.Properties[2].Value

$rv.ReasonCode = $_.Properties[3].Value

$rv.Comment = $_.Properties[5].Value

$rv

} | Select-Object Date, Action, Reason, User

#fim

 

 

Fonte: https://social.technet.microsoft.com/wiki/contents/articles/17889.powershell-script-for-shutdownreboot-events-tracker.aspx

 

#script #powershell #reboot #ps #windows #server