As an extension to my article on how to Audit Server Reboots, I have put forth a small script that might come handy.

I consciously choose implementing WMI rather than inbuilt command lets as there were several Legacy OS’s still in our enterprise and using the command lets had their own share of issues with fetching the data.

Here is what it does,

  • Retrieves event logs pertaining to Windows Reboots via WMI between 2 dates provided by user.
  • Script runs/retrieves the data using the current logged in user credentials by default.
  • Creates 2 Logs, one with a Snapshot of all the restarts, scheduled vs unscheduled reboots and a full report with detailed information.


2,429 total views, 2 views today