PowerShell

Find Operating System Start time using Powershell.

Aman Dhally

Today, I have been asked  to do a strange task, My manager told me to find a Operating System Start time.

I was thinking about an half hour  on how to get this done, then i thought about Event Logs, every thing is recorded there, after a few minutes of hardworking , i have found the event which tells us about the Start time of the Operating System.

He wants a history of  start up time of all dates, and luckily windows keep history of start up time in Event Logs.

The Event ID : 12, shows a information on at what time the Operating system was  started.

11-10-2013 17-23-24

and we know how to use Powershell and  how to use Get-EventLog cmdlet.

and then it a matter of few seconds , and I have the list of Operating System’s start time.

run the below command to get the list of start time of the operating system.

Get-EventLog -Log System  |  Where {  $_.EventID -eq 12    } | SelectTimeGenerated

 

Here is the result.

11-10-2013 20-15-13

Tested on : Windows7 (64 Bit)

Happy Weekend. Have fun 🙂 .

Thanks

Aman Dhally

clip_image001 clip_image002 clip_image003 clip_image005  clip_image007

8 thoughts on “Find Operating System Start time using Powershell.”

  2. It’s endlessly fascinating to me that Windows doesn’t maintain this as something more easily attained than scraping through an eventlog. And to have to write a script to dig through and find it. Unix has had this right forever……”uptime”

    1. Hi

      You can use this [Management.ManagementDateTimeConverter]::ToDateTime((gwmi win32_operatingsystem).LastBootupTime)
      to get a uptime quickly.

      But if you need a history of system time, then the Event log are the only way.

      t
      aman

  3. An alternate way could be, Get-CIMInstance -ClassName Win32_OperatingSystem | Select-Object -Property LastBootUptime
    Thanks for the info about Event Logs.

    1. Thanks Prakash,

      Yes you can do that, but this will give up boot time of the current session/login.

      What if , if you was a boot time history of last 10 days or 30 days, you can them only by Event logs 🙂

      t
      aman

Comments are closed.