1 min read

Powershell - Get-WinEvent initiated reboots, EventID 1074

Powershell - Get-WinEvent initiated reboots, EventID 1074

EDIT 2022-02-03

Got some nice feedback on improvement and updated the whole script, made it into a function, and improved handling and output.


So, we had a couple of servers being restarted and we needed a quick way to get the information from multiple machines.
So, i came up with this short script to fetch the events from machines eventlog.

You can run it from a machine which has ports open to them, or run it locally. You can add multiple entries to the "$Servers" variable and the script cycle through them and append the out-file with each.

Function Get-ServerRestartInformation{
    [cmdletbinding(SupportsShouldProcess=$True)]
    Param(
        [Parameter(Mandatory=$True)]
        [string[]]$Servers = '',

        [Parameter(Mandatory=$False)]
        $MaxEvents = '',

        [Parameter(Mandatory=$false)]
        $OutFileLocation,

        [Parameter(Mandatory=$false)]
        $OutFileName,

        [Parameter(Mandatory=$true)]
        $DaysBack
    )

    #Set get-winevent parameters and create hashtables
    Begin{
        $Date = (Get-Date).AddDays(-$DaysBack)
        
        $FilterHashTable = @{
            LogName='System'
            StartTime=$Date
            id=1074
        }

        $OutFile = $null
        If(![string]::IsNullOrEmpty($OutFileName) -and ($OutFileLocation)){
            $OutFile = "$OutfileLocation"+"\"+"$OutFileName"+".txt"
        }

        $EventLogInfo = $null
        $EventLogInfo = @{}
        $Events = $null
        $Events = @{}
    }

    #Get events
    Process{
        Foreach($Server in $Servers){
            Try{
                Write-Output "Fetching events for $Server"
                $Events = Get-WinEvent -ComputerName $Server -FilterHashTable $FilterHashTable | FT -AutoSize
                $EventLogInfo = foreach($event in $events){
                    $Event
                }
            }
            Catch{
                Write-Output $_.Exception.message
            }
        }
    }

    #Write-output and create file if used
    End{
        if(![string]::IsNullOrEmpty($OutFile)){
            $EventLogInfo | Out-File -FilePath $Outfile
        }
            Write-Output $EventLogInfo
    }
}