Determine last boot time
In PowerShell, the last boot time can be determined with
(get-cimInstance -className win32_operatingSystem).lastBootUpTime
With Powershell 7, the last boot time can be determined with
PS C:\> get-uptime -since
A list of boot times can be produced (PowerShell 5 and 7) with.
PS C:\> get-eventLog system | where-object {$_.eventID -eq 6005} | sort-object timeGenerated -descending
The event 6005 corresponds to The event log service was started which is the case at boot time.
C:\> systeminfo | findstr /c:"System Boot Time:"
Because systeminfo.exe is localized, the text System Boot Time needs to be changed on Windows with a non-English installation language.
TODO
Every time the NT kernel initializes, it always turns on the TerminalServer mask in ProductSuite. See the implementation of ExpWatchProductTypeInitialization in minkernel\ntos\ex\exinit.c (ExpSuiteMask is the variable of interest).
Pressing F8 before the Windows logo is displayed starts Windows in advanced troubleshoot modus.
Determine reason of last shutdown
get-winEvent -filterHashtable @{ LogName = 'System'; Id = 41, 1074, 6006, 6605, 6008; } |
sort-object timeCreated |
format-list Id, LevelDisplayName, TimeCreated, Message
The event 6006 is The Event log service was stopped and indicates a proper system shutdown.