Find Shutdown Events
Just a quick PowerShell one-liner to display all the shutdown events on a computer.
get-eventlog -LogName system | where eventid -in 41,1074,1076,6005,6006,6008,6009 | ft timegenerated,eventid,username,message -autosize -wrap
If you modify this slightly by adding the -computername switch, you can get the shutdown events for remote computers as well.
Loading Comments ...
Comments
No comments have been added for this post.
You must be logged in to make a comment.