PowerShell – Retrieve System Startup Time Information

The below script gathers the following system startup time information from a local or remote client.

Computername
Last Wakeup time (from Sleep, Hibernate or Fast boot on Windows 8x clients)
The last wakeup date/time is converted from UTC into the client local time.
Last Boot time
The Time Zone of the client
The system wakeup / sleep message from the Windows event log

Important: the script uses PowerShell remoting, it’s therefore required that the targeted clients have WinRM enabled.

Function Get-SystemStartInfo()
 {
 &lt;#
 .Synopsis
 Get System Boot / Wake-up Time 
 .DESCRIPTION
 This script retrieves system boot and wakeup times from the specified client(s). 
 On Windows 8x clients, the last Wake-up time is the last time the system performed a 
 fast boot. 
 .PARAMETER Computer
 The name of one or multiple clients
 .EXAMPLE
 Get-SystemStartInfo localhost, dev001 | Format-Table -AutoSize

 Computer LastWakeupTime LastBootTime TimeZone 
 -------- -------------- ------------ -------- 
 localhost 1/5/2014 11:55:41 PM 1/5/2014 2:35:44 PM (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm,...
 dev001 1/5/2014 11:55:41 PM 1/5/2014 2:35:44 PM (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm,...

.NOTES
 WinRM must be enabled on remote clients
 #&gt;
 
[CmdletBinding()]
 Param(
    [Parameter(Mandatory=$true,
    ValueFromPipelineByPropertyName=$true,HelpMessage="Enter Computername(s)",
    Position=0)]
    [Alias("ipaddress","host")]
    [String[]]$Computer
    )

Begin
{
    Function Get-LocalTime($UTCTime,$Comp)
    {
        #Credits to Tao Yang for the Get-LocalTime function
        #http://blog.tyang.org/2012/01/11/powershell-script-convert-to-local-time-from-utc/
        #$strCurrentTimeZone = (Get-WmiObject win32_timezone).StandardName
        $strCurrentTimezone = Get-CimInstance -ComputerName $Comp -Namespace root/CIMV2 -ClassName win32_TimeZone | Select-Object -ExpandProperty StandardName -ErrorAction SilentlyContinue
        $TZ = [System.TimeZoneInfo]::FindSystemTimeZoneById($strCurrentTimeZone) 
        $LocalTime = [System.TimeZoneInfo]::ConvertTimeFromUtc($UTCTime, $TZ)
        Return $LocalTime, $TZ
    }
}
Process
{
    $SystemStartInfo=@()
    foreach ($c in $Computer)
    {
        Write-Output "Processing $c"
        if (Test-Connection -ComputerName $c -Quiet -Count 3 )
        {
            # The last boot date time
            $LBootLocal = Get-CimInstance -ComputerName $c -Namespace root/CIMV2 -ClassName Win32_OperatingSystem -ErrorAction SilentlyContinue | Select -ExpandProperty LastBootuptime -ErrorAction SilentlyContinue
            If([string]::IsNullOrEmpty($LBootLocal) -eq $true)
            {
                # No last boot time found
                $LBootLocal=""
            }
            
            $PowerEvent = Invoke-Command -ComputerName $c -ScriptBlock {
            $orgCulture = Get-Culture
            [System.Threading.Thread]::CurrentThread.CurrentCulture = New-Object "System.Globalization.CultureInfo" "en-US"
            $PowerEvent = Get-WinEvent -ProviderName "Microsoft-Windows-Power-Troubleshooter" -MaxEvents 1 -ErrorAction SilentlyContinue | Where-Object { $_.id -eq 1 } | Select-Object -ExpandProperty  Message -ErrorAction SilentlyContinue
            [System.Threading.Thread]::CurrentThread.CurrentCulture = $orgCulture
            return $PowerEvent
            } 
            
            If($PowerEvent.count -gt 0)
            {
                # Extract the Date / Time information when the system woke up
                $wake = ($PowerEvent.Replace("`n","@").split("@")[3]).replace("Wake Time: ","")
                [string]$utcyear = $wake.Substring(1,4)
                [string]$utcmonth = $wake.Substring(8,2)
                [string]$utcday = $wake.Substring(13,2)
                [string]$utchour = $wake.Substring(16,2)
                [string]$utcminute = $wake.Substring(19,2)
                [string]$utcseconds = $wake.Substring(22,2)
                $wakedt = $utcyear + $utcmonth + $utcday + $utchour + $utcminute + $utcseconds

                $Culture = [System.Globalization.CultureInfo]::InvariantCulture 

                #The datetime in UTC format
                $LWUTC = [datetime]::ParseExact($wakedt,"yyyyMMddHHmmss",$Culture)
                # The datetime in Local Time format
                $LWLocal = Get-LocalTime $LWUTC $c
            }
            Else
            {
                #No last wake up event found, so let's just get the TimeZone information
                $TZName = Get-CimInstance -ComputerName $c -Namespace root/CIMV2 -ClassName win32_TimeZone | Select-Object -ExpandProperty StandardName -ErrorAction SilentlyContinue
                $TZ = [System.TimeZoneInfo]::FindSystemTimeZoneById($TZName) 
                $LWLocal = "","$TZ"
                $PowerEvent = ""
            }

            $object = New-Object -TypeName PSObject
            $object | Add-Member -MemberType NoteProperty -Name "Computer" -Value $c
            $object | Add-Member -MemberType NoteProperty -Name "LastWakeupTime" -Value $LWLocal[0]
            $object | Add-Member -MemberType NoteProperty -Name "LastBootTime" -Value $LBootLocal
            $object | Add-Member -MemberType NoteProperty -Name "TimeZone" -Value $LWLocal[1]
            $object | Add-Member -MemberType NoteProperty -Name "Message" -Value $PowerEvent
            $SystemStartInfo += $object
        }
Else
        {
        Write-Verbose "Unable to connect to $c"
        }
    }
}
End
{
    return $SystemStartInfo 
}
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

Function Get-SystemStartInfo()

{

.Synopsis

Get System Boot / Wake-up Time

.DESCRIPTION

This script retrieves system boot and wakeup times from the specified client(s).

On Windows 8x clients, the last Wake-up time is the last time the system performed a

fast boot.

.PARAMETER Computer

The name of one or multiple clients

.EXAMPLE

Get-SystemStartInfo localhost, dev001 | Format-Table -AutoSize

Computer LastWakeupTime LastBootTime TimeZone

-------- -------------- ------------ --------

localhost 1/5/2014 11:55:41 PM 1/5/2014 2:35:44 PM (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm,...

dev001 1/5/2014 11:55:41 PM 1/5/2014 2:35:44 PM (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm,...

.NOTES

WinRM must be enabled on remote clients

[CmdletBinding()]

Param(

[Parameter(Mandatory=$true,

ValueFromPipelineByPropertyName=$true,HelpMessage="Enter Computername(s)",

Position=0)]

[Alias("ipaddress","host")]

[String[]]$Computer

)

Begin

{

Function Get-LocalTime($UTCTime,$Comp)

{

#Credits to Tao Yang for the Get-LocalTime function

#http://blog.tyang.org/2012/01/11/powershell-script-convert-to-local-time-from-utc/

#$strCurrentTimeZone = (Get-WmiObject win32_timezone).StandardName

$strCurrentTimezone = Get-CimInstance -ComputerName $Comp -Namespace root/CIMV2 -ClassName win32_TimeZone | Select-Object -ExpandProperty StandardName -ErrorAction SilentlyContinue

$TZ = [System.TimeZoneInfo]::FindSystemTimeZoneById($strCurrentTimeZone)

$LocalTime = [System.TimeZoneInfo]::ConvertTimeFromUtc($UTCTime, $TZ)

Return $LocalTime, $TZ

}

Process

{

$SystemStartInfo=@()

foreach ($c in $Computer)

{

Write-Output "Processing $c"

if (Test-Connection -ComputerName $c -Quiet -Count 3 )

{

# The last boot date time

$LBootLocal = Get-CimInstance -ComputerName $c -Namespace root/CIMV2 -ClassName Win32_OperatingSystem -ErrorAction SilentlyContinue | Select -ExpandProperty LastBootuptime -ErrorAction SilentlyContinue

If([string]::IsNullOrEmpty($LBootLocal) -eq $true)

{

# No last boot time found

$LBootLocal=""

}

$PowerEvent = Invoke-Command -ComputerName $c -ScriptBlock {

$orgCulture = Get-Culture

[System.Threading.Thread]::CurrentThread.CurrentCulture = New-Object "System.Globalization.CultureInfo" "en-US"

$PowerEvent = Get-WinEvent -ProviderName "Microsoft-Windows-Power-Troubleshooter" -MaxEvents 1 -ErrorAction SilentlyContinue | Where-Object { $_.id -eq 1 } | Select-Object -ExpandProperty Message -ErrorAction SilentlyContinue

[System.Threading.Thread]::CurrentThread.CurrentCulture = $orgCulture

return $PowerEvent

}

If($PowerEvent.count -gt 0)

{

# Extract the Date / Time information when the system woke up

$wake = ($PowerEvent.Replace("`n","@").split("@")[3]).replace("Wake Time: ","")

[string]$utcyear = $wake.Substring(1,4)

[string]$utcmonth = $wake.Substring(8,2)

[string]$utcday = $wake.Substring(13,2)

[string]$utchour = $wake.Substring(16,2)

[string]$utcminute = $wake.Substring(19,2)

[string]$utcseconds = $wake.Substring(22,2)

$wakedt = $utcyear + $utcmonth + $utcday + $utchour + $utcminute + $utcseconds

$Culture = [System.Globalization.CultureInfo]::InvariantCulture

#The datetime in UTC format

$LWUTC = [datetime]::ParseExact($wakedt,"yyyyMMddHHmmss",$Culture)

# The datetime in Local Time format

$LWLocal = Get-LocalTime $LWUTC $c

}

Else

{

#No last wake up event found, so let's just get the TimeZone information

$TZName = Get-CimInstance -ComputerName $c -Namespace root/CIMV2 -ClassName win32_TimeZone | Select-Object -ExpandProperty StandardName -ErrorAction SilentlyContinue

$TZ = [System.TimeZoneInfo]::FindSystemTimeZoneById($TZName)

$LWLocal = "","$TZ"

$PowerEvent = ""

}

$object = New-Object -TypeName PSObject

$object | Add-Member -MemberType NoteProperty -Name "Computer" -Value $c

$object | Add-Member -MemberType NoteProperty -Name "LastWakeupTime" -Value $LWLocal[0]

$object | Add-Member -MemberType NoteProperty -Name "LastBootTime" -Value $LBootLocal

$object | Add-Member -MemberType NoteProperty -Name "TimeZone" -Value $LWLocal[1]

$object | Add-Member -MemberType NoteProperty -Name "Message" -Value $PowerEvent

$SystemStartInfo += $object

}

Else

{

Write-Verbose "Unable to connect to $c"

}

End

{

return $SystemStartInfo

}

Example:

Get-Systemstartupinfo client1,client2,client3,client4,client5, client6 | format-list

1	Get-Systemstartupinfo client1,client2,client3,client4,client5, client6 \| format-list

Computer       : client1
LastWakeupTime :
LastBootTime   : 24.12.2013 12:28:41
TimeZone       : (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna
Message        :

Computer       : client2
LastWakeupTime : 06.01.2014 08:33:04
LastBootTime   : 06.01.2014 08:29:08
TimeZone       : (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna
Message        : The system has resumed from sleep.

                 Sleep Time: ?2014?-?01?-?06T07:32:42.550130000Z
                 Wake Time: ?2014?-?01?-?06T07:33:04.780800500Z

                 Wake Source: Device -Intel(R) 82579LM Gigabit Network Connection

Computer       : client3
LastWakeupTime : 29.12.2013 19:17:22
LastBootTime   : 06.01.2014 00:55:57
TimeZone       : (UTC+08:00) Beijing, Chongqing, Hong Kong, Urumqi
Message        : The system has resumed from sleep.

                 Sleep Time: ?2013?-?12?-?29T11:05:17.427355600Z
                 Wake Time: ?2013?-?12?-?29T11:17:22.762004000Z

                 Wake Source: Power Button

Computer       : client4
LastWakeupTime : 06.01.2014 10:03:57
LastBootTime   : 06.01.2014 09:55:36
TimeZone       : (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna
Message        : The system has resumed from sleep.

                 Sleep Time: ?2014?-?01?-?06T09:01:05.727399400Z
                 Wake Time: ?2014?-?01?-?06T09:03:57.248801300Z

                 Wake Source: Power Button

Computer       : client5
LastWakeupTime : 13.12.2013 13:27:33
LastBootTime   : 06.01.2014 09:28:39
TimeZone       : (UTC) Dublin, Edinburgh, Lisbon, London
Message        : The system has resumed from sleep.

                 Sleep Time: ?2013?-?12?-?13T12:32:42.342018800Z
                 Wake Time: ?2013?-?12?-?13T13:27:33.513115200Z

                 Wake Source: Device -USB Root Hub

Computer       : client6
LastWakeupTime :
LastBootTime   : 06.01.2014 01:23:48
TimeZone       : (UTC+10:00) Canberra, Melbourne, Sydney
Message        :

PowerShell – Retrieve System Startup Time Information

Like this:

Leave a Reply Cancel reply