powershell.ps1

Boot

Get-WinEvent -FilterHashtable @{logname='System'; id=6009}

Shutdown

Get-WinEvent -FilterHashtable @{logname='System'; id=1074}

v2

Get-EventLog System -Newest 10000 | Where EventId -in 41,1074,1076,6005,6006,6008,6009,6013 | Format-Table TimeGenerated,EventId,UserName,Message -AutoSize -wrap

Izvor: hxxps://www.shellhacks.com/windows-shutdown-reboot-event-ids-get-logs

---

boot reboot xboot xreboot