Mike Swanson
31088cb8de
Author: Mike Swanson Machine: DESKTOP-0O8A1RL Timestamp: 2026-05-15 15:23:02
19 lines
665 B
PowerShell
19 lines
665 B
PowerShell
$start = [datetime]'2026-05-14 18:00:00'
|
|
$end = [datetime]'2026-05-15 00:00:00'
|
|
|
|
# Shutdown/crash/service events
|
|
$evts = Get-WinEvent -LogName System -MaxEvents 5000 -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.TimeCreated -gt $start -and $_.TimeCreated -lt $end }
|
|
|
|
Write-Host "Total events in window: $($evts.Count)"
|
|
|
|
# Events we care about
|
|
$ids = @(1074,6006,6008,6009,41,7034,7035,7036)
|
|
$relevant = $evts | Where-Object { $_.Id -in $ids }
|
|
|
|
foreach ($e in ($relevant | Sort-Object TimeCreated)) {
|
|
$ts = $e.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss')
|
|
$msg = ($e.Message -split "`n")[0] -replace '\s+',' '
|
|
Write-Host "$ts ID=$($e.Id) $msg"
|
|
}
|