Find Shutdown Events
Just a quick PowerShell one-liner to display all the shutdown events on a computer.
get-eventlog -LogName system | where eventid -in 41,1074,1076,6005,6006,6008,6009 | ft timegenerated,eventid,username,message -autosize -wrap
If you modify this slightly by adding the -computername switch, you can get the shutdown events for remote computers as well.
About this post
Posted: 2022-07-08
By: dwirch
Viewed: 212 times
Categories
Scripting
Powershell
Windows
PowerShell Code Cache
Attachments
Loading Comments ...
Comments
No comments have been added for this post.
You must be logged in to make a comment.