This is a question that I often have to ask a user. The problem is that our users answers cannot always be considered…shall we say “reliable.” Below is a PowerShell function that you can use to to determine when the client in question was last started. Here is what you get when you run this function.
PS C:\windows\system32> Get-LastStartTime -ComputerName Work-PC
Last Startup Time: 12/31/2012 1:44:43 PM
I’m using this as part of the HelpDesk module that I creating for my up coming book and also I’ll be demonstrating the full module at the Cincinnati PowerShell users group meet up on Thursday, February 21, 2013. Here is a link to the event. Our focus will be on using PowerShell with your Help Desk.
# .............................................................................
# Function Get-LastStartTime
# Retrieves the last start time on the client machine.
Function Get-LastStartTime
{
Param ($ComputerName = ".",
[Switch]$PassThru
)
If (!$Quiet)
{
Write-Host "Last Startup Time: " `
-ForegroundColor Cyan `
-BackgroundColor DarkBlue `
-NoNewline
}
$Events = Invoke-Command -ScriptBlock {
Try
{
$LogHash = @{LogName = 'System'; ID = 6005}
Get-WinEvent -FilterHashtable $LogHash `
-MaxEvents 1 `
-ErrorAction Stop
}
Catch
{
}
} -ComputerName $ComputerName
If (!$Quiet)
{
If ($Events -ne $Null)
{Write-Host ($Events.TimeCreated).ToString() `
-ForegroundColor Green `
-BackgroundColor DarkBlue}
Else
{Write-Host "Could not determine the last start time." `
-ForegroundColor Red `
-BackgroundColor DarkRed}
}
# If $Passthru is enabled, then return the results of this test
# to the PowerShell pipeline.
If($PassThru) {Write-Output $Events}
<#
.SYNOPSIS
Returns the time the client was last started.
.DESCRIPTION
Returns the time the client was last started.
.PARAMETER ComputerName
the name of a client to connect to.
.PARAMETER PassThru
Returns the test result from this cmdlet.
.EXAMPLE
Get-LastStartTime -ComputerName Work-PC
Last Startup Time: 12/31/2012 1:44:43 PM
.EXAMPLE
Get-LastStartTime -ComputerName Work-PC -PassThru
Last Startup Time: 12/31/2012 1:44:43 PM
ProviderName: EventLog
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
12/31/2012 1:44:43 PM 6005 Information The Event log service was started.
#>
} # End Function: Get-LastStartTime -------------------------------------------
Comments