Tuesday, March 18, 2025

Get Restart log using PowerShell

I'm often curious about a restart on a Windows server system.

An easy way to get a list of the restart and what initiated it is to use the following powershell script.

$eventIDs = @(1074, 6008, 6009)

Get-EventLog -LogName System | Where-Object { $eventIDs -contains $_.EventID } | Sort-Object -Property TimeGenerated | Select-Object EventID, TimeGenerated, Message | Format-Table -AutoSize -Wrap


It will produce output similar to this: 



No comments:

Get Restart log using PowerShell

I'm often curious about a restart on a Windows server system. An easy way to get a list of the restart and what initiated it is to use t...