PowerShell - Retrieve System Startup Time Information

Posted by Alex Verboon on Monday, January 6, 2014

The below script gathers the following system startup time information from a local or remote client.

  • Computername
  • Last Wakeup time (from Sleep, Hibernate or Fast boot on Windows 8x clients) The last wakeup date/time is converted from UTC into the client local time.
  • Last Boot time
  • The Time Zone of the client
  • The system wakeup / sleep message from the Windows event log

Important: the script uses PowerShell remoting, it’s therefore required that the targeted clients have WinRM enabled.

Function Get-SystemStartInfo()
 {
 <#
 .Synopsis
 Get System Boot / Wake-up Time
 .DESCRIPTION
 This script retrieves system boot and wakeup times from the specified client(s).
 On Windows 8x clients, the last Wake-up time is the last time the system performed a
 fast boot.
 .PARAMETER Computer
 The name of one or multiple clients
 .EXAMPLE
 Get-SystemStartInfo localhost, dev001 | Format-Table -AutoSize
 Computer LastWakeupTime LastBootTime TimeZone
 -------- -------------- ------------ --------
 localhost 1/5/2014 11:55:41 PM 1/5/2014 2:35:44 PM (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm,...
 dev001 1/5/2014 11:55:41 PM 1/5/2014 2:35:44 PM (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm,...
.NOTES
 WinRM must be enabled on remote clients
 #>
[CmdletBinding()]
 Param(
    [Parameter(Mandatory=$true,
    ValueFromPipelineByPropertyName=$true,HelpMessage="Enter Computername(s)",
    Position=0)]
    [Alias("ipaddress","host")]
    [String[]]$Computer
    )
Begin
{
    Function Get-LocalTime($UTCTime,$Comp)
    {
        #Credits to Tao Yang for the Get-LocalTime function
        #http://blog.tyang.org/2012/01/11/powershell-script-convert-to-local-time-from-utc/
        #$strCurrentTimeZone = (Get-WmiObject win32_timezone).StandardName
        $strCurrentTimezone = Get-CimInstance -ComputerName $Comp -Namespace root/CIMV2 -ClassName win32_TimeZone | Select-Object -ExpandProperty StandardName -ErrorAction SilentlyContinue
        $TZ = [System.TimeZoneInfo]::FindSystemTimeZoneById($strCurrentTimeZone)
        $LocalTime = [System.TimeZoneInfo]::ConvertTimeFromUtc($UTCTime, $TZ)
        Return $LocalTime, $TZ
    }
}
Process
{
    $SystemStartInfo=@()
    foreach ($c in $Computer)
    {
        Write-Output "Processing $c"
        if (Test-Connection -ComputerName $c -Quiet -Count 3 )
        {
            # The last boot date time
            $LBootLocal = Get-CimInstance -ComputerName $c -Namespace root/CIMV2 -ClassName Win32_OperatingSystem -ErrorAction SilentlyContinue | Select -ExpandProperty LastBootuptime -ErrorAction SilentlyContinue
            If([string]::IsNullOrEmpty($LBootLocal) -eq $true)
            {
                # No last boot time found
                $LBootLocal=""
            }
            $PowerEvent = Invoke-Command -ComputerName $c -ScriptBlock {
            $orgCulture = Get-Culture
            [System.Threading.Thread]::CurrentThread.CurrentCulture = New-Object "System.Globalization.CultureInfo" "en-US"
            $PowerEvent = Get-WinEvent -ProviderName "Microsoft-Windows-Power-Troubleshooter" -MaxEvents 1 -ErrorAction SilentlyContinue | Where-Object { $_.id -eq 1 } | Select-Object -ExpandProperty  Message -ErrorAction SilentlyContinue
            [System.Threading.Thread]::CurrentThread.CurrentCulture = $orgCulture
            return $PowerEvent
            }
            If($PowerEvent.count -gt 0)
            {
                # Extract the Date / Time information when the system woke up
                $wake = ($PowerEvent.Replace("`n","@").split("@")[3]).replace("Wake Time: ","")
                [string]$utcyear = $wake.Substring(1,4)
                [string]$utcmonth = $wake.Substring(8,2)
                [string]$utcday = $wake.Substring(13,2)
                [string]$utchour = $wake.Substring(16,2)
                [string]$utcminute = $wake.Substring(19,2)
                [string]$utcseconds = $wake.Substring(22,2)
                $wakedt = $utcyear + $utcmonth + $utcday + $utchour + $utcminute + $utcseconds
                $Culture = [System.Globalization.CultureInfo]::InvariantCulture
                #The datetime in UTC format
                $LWUTC = [datetime]::ParseExact($wakedt,"yyyyMMddHHmmss",$Culture)
                # The datetime in Local Time format
                $LWLocal = Get-LocalTime $LWUTC $c
            }
            Else
            {
                #No last wake up event found, so let's just get the TimeZone information
                $TZName = Get-CimInstance -ComputerName $c -Namespace root/CIMV2 -ClassName win32_TimeZone | Select-Object -ExpandProperty StandardName -ErrorAction SilentlyContinue
                $TZ = [System.TimeZoneInfo]::FindSystemTimeZoneById($TZName)
                $LWLocal = "","$TZ"
                $PowerEvent = ""
            }
            $object = New-Object -TypeName PSObject
            $object | Add-Member -MemberType NoteProperty -Name "Computer" -Value $c
            $object | Add-Member -MemberType NoteProperty -Name "LastWakeupTime" -Value $LWLocal[0]
            $object | Add-Member -MemberType NoteProperty -Name "LastBootTime" -Value $LBootLocal
            $object | Add-Member -MemberType NoteProperty -Name "TimeZone" -Value $LWLocal[1]
            $object | Add-Member -MemberType NoteProperty -Name "Message" -Value $PowerEvent
            $SystemStartInfo += $object
        }
Else
        {
        Write-Verbose "Unable to connect to $c"
        }
    }
}
End
{
    return $SystemStartInfo
}
}
```powershell
Example:

```powershell
Get-Systemstartupinfo client1,client2,client3,client4,client5, client6 | format-list

Computer : client1 LastWakeupTime : LastBootTime : 24.12.2013 12:28:41 TimeZone : (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna Message :

Computer : client2 LastWakeupTime : 06.01.2014 08:33:04 LastBootTime : 06.01.2014 08:29:08 TimeZone : (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna Message : The system has resumed from sleep.

             Sleep Time: ?2014?-?01?-?06T07:32:42.550130000Z
             Wake Time: ?2014?-?01?-?06T07:33:04.780800500Z

             Wake Source: Device -Intel(R) 82579LM Gigabit Network Connection

Computer : client3 LastWakeupTime : 29.12.2013 19:17:22 LastBootTime : 06.01.2014 00:55:57 TimeZone : (UTC+08:00) Beijing, Chongqing, Hong Kong, Urumqi Message : The system has resumed from sleep.

             Sleep Time: ?2013?-?12?-?29T11:05:17.427355600Z
             Wake Time: ?2013?-?12?-?29T11:17:22.762004000Z

             Wake Source: Power Button

Computer : client4 LastWakeupTime : 06.01.2014 10:03:57 LastBootTime : 06.01.2014 09:55:36 TimeZone : (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna Message : The system has resumed from sleep.

             Sleep Time: ?2014?-?01?-?06T09:01:05.727399400Z
             Wake Time: ?2014?-?01?-?06T09:03:57.248801300Z

             Wake Source: Power Button

Computer : client5 LastWakeupTime : 13.12.2013 13:27:33 LastBootTime : 06.01.2014 09:28:39 TimeZone : (UTC) Dublin, Edinburgh, Lisbon, London Message : The system has resumed from sleep.

             Sleep Time: ?2013?-?12?-?13T12:32:42.342018800Z
             Wake Time: ?2013?-?12?-?13T13:27:33.513115200Z

             Wake Source: Device -USB Root Hub

Computer : client6 LastWakeupTime : LastBootTime : 06.01.2014 01:23:48 TimeZone : (UTC+10:00) Canberra, Melbourne, Sydney Message :