# encoding: utf-8
# api: powershell
# title: Get-RebootHistory
# description: http://www.powershellmagazine.com/2012/10/15/pstip-get-your-reboot-history/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+PowershellMagazine+%28PowerShell+Magazine%29
# version: 0.1
# type: function
# author: Fishee
# license: CC0
# function: Get-RebootHistory
# x-poshcode-id: 4440
# x-archived: 2016-10-30T00:40:52
# x-published: 2013-09-04T16:41:00
#
#
function Get-RebootHistory{
<#
.SYNOPSIS
PSTip Get your reboot history.
.DESCRIPTION
Have you ever wondered how often is your station rebooted? Let�s ask the Windows Event Log and get time of last five reboots. You will use the Get-WinEvent cmdlet to connect to System event log. You are interested in �The Event log service was started.� event which has Id 6005.
.EXAMPLE
Get-RebootHistory
PS C:> .\Get-RebootHistory.ps1
ComputerName Reboots
------------ -------
TEST11122 {System.Diagnostics.Eventing.Reader.EventLogRecord, Syst...
.NOTES
There is of course a 6006 event if you are more interested in shutdowns.
Since operating sytstems can halt or a power failure may occur, the 1074 may not be present in the system log, making false impression nothing has happened.
.LINK
http://www.powershellmagazine.com/2012/10/15/pstip-get-your-reboot-history/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+PowershellMagazine+%28PowerShell+Magazine%29
#>
[cmdletbinding()]
param(
#The list of computers you want to get. The default is $env:ComputerName.
[Parameter(Mandatory=$False,ValueFromPipeline=$true)]
[string[]]$ComputerName=$env:COMPUTERNAME,
#You can get 6005 or 6006. The default is 6005.
[ValidateSet(6005,6006)]
[int]$EventID=6005,
#The number of events you want to get back. If none is supplied, it returns all recorded events.
[ValidateRange(1,[uint32]::MaxValue)]
[int]$MaxEvents=0
)
begin{
$xml=@"
<QueryList>
<Query Id="0" Path="System">
<Select Path="System">*[System[(EventID=$EventID)]]</Select>
</Query>
</QueryList>
"@
$EventArgs = @{FilterXml=$xml;ErrorAction='Stop'}
if($MaxEvents){
$EventArgs['MaxEvents'] = $MaxEvents
}
}
process{
foreach($Computer in $ComputerName){
try{
Write-Output ([PSCustomObject]@{ComputerName=$Computer;Reboots=(Get-WinEvent -ComputerName $Computer @EventArgs)})
}
catch{
Write-Error "Could not get reboot history from '$Computer'. $($Error[0])"
}
}
}
end{}
}