Understanding System Reboot History with PowerShell

In today’s post, I’ll share a powerful PowerShell script I developed for monitoring system reboots across an enterprise environment. This script efficiently retrieves and analyzes reboot history from multiple computers, providing valuable insights into system stability and user behavior.

The Script’s Core Functions

The script centers around a custom function called **Get-RebootHistory**, which leverages Windows Event Logs to track both planned and unexpected shutdowns. Let’s break down its key components:

Parameters and Flexibility

• ComputerName: Accepts single or multiple computer names (defaults to local machine)
• DaysFromToday: Customizable timeframe for history retrieval (default: 7 days)
• MaxEvents: Limit on number of events to retrieve (default: 9999)

Technical Implementation

Function Get-RebootHistory {
    [CmdletBinding()]
    param(
        [Parameter(
            Mandatory = $false,
            ValueFromPipeline = $true,
            ValueFromPipelineByPropertyName = $true
        )]
        [string[]]  $ComputerName = $env:COMPUTERNAME,

        [int]       $DaysFromToday = 7,

        [int]       $MaxEvents = 9999
    )

The script monitors two critical event IDs:

• 1074: Planned shutdowns and restarts
• 6008: Unexpected shutdowns

Error Handling and Output

The script implements robust error handling and outputs structured data including:

• TimeStamp
• ComputerName
• UserName
• ShutdownType

Practical Applications

This tool proves invaluable for:

• System Administrators monitoring enterprise-wide reboot patterns
• Security Teams investigating unexpected shutdowns
• IT Support tracking user-initiated system restarts
• Compliance Officers maintaining system availability records

Implementation Insights

The script uses several advanced PowerShell features:

• CmdletBinding for advanced function capabilities
• Pipeline support for processing multiple computers
• Error Action handling for robust execution
• Custom Object creation for standardized output

This script represents part of my broader toolkit for enterprise system monitoring and management. It demonstrates the power of PowerShell in creating efficient, scalable solutions for IT infrastructure management. For more technical scripts and IT solutions, explore my other posts or reach out through my contact page.

[View the complete script on my GitHub repository]