Search notes:

Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows

Directory

The default value of Directory is %systemRoot%.
Compare with the value of SystemRoot.

NoInteractiveServices

The value of NoInteractiveServices determines if a service is allowed to run interactively: 0: allowed 1: not allowed
The default is 1

ShutdownTime

ShutdownTime contains an 64-bit RegBinary value that contains the last shutdown time encoded as a FILETIME.
The following script tries to convert this 64-bit number to a Unix time (using the script FILETIME-to-Unixtime.ps1 and then to convert this number to a .NET DateTime struct. 
set-strictMode -version latest

. ../../../../../scripts/FILETIME-to-Unixtime.ps1

[byte[]] $shutdown_FILETIME = (get-itemProperty -path HKLM:\SYSTEM\CurrentControlSet\Control\Windows).ShutdownTime

$unixTime = FILETIME-to-Unixtime $shutdown_FILETIME

$t0 = new-object -type DateTime -argumentList 1970, 1, 1, 0, 0, 0, 0

$tShutdown = $t0.AddSeconds($unixTime)

$tShutdown.ToLocalTime()

#
# Compare the calculated value with the the following one
#
(get-CimInstance win32_Operatingsystem).lastbootuptime
Github repository about-Windows-Registry, path: /HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Windows/ShutdownTime.ps1

SystemDirectory

The default value of SystemDirectory is %SystemRoot%\system32
Compare with the value of Directory.

Index