Skip to content

Instantly share code, notes, and snippets.

@SweetAsNZ
Created August 1, 2022 06:08
Show Gist options
  • Select an option

  • Save SweetAsNZ/6e9d32bffb44e609b5398141461db4b9 to your computer and use it in GitHub Desktop.

Select an option

Save SweetAsNZ/6e9d32bffb44e609b5398141461db4b9 to your computer and use it in GitHub Desktop.
Get Who Shutdown A Windows Server or PC
function Get-ShutdownUser
{
[CmdletBinding()]
Param
(
[Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true)]
[bool]$ShowInfo = $false,
[Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true)]
[string]$Computer
)
if($Computer -eq $null -or $COmputer -eq ""){
$Computer = ($env:COMPUTERNAME)
}
# Gets the User, reason, reason code and shutdown type e.g. 'power off'
Get-WinEvent -ComputerName $Computer -FilterHashtable @{logname = 'System'; id = 1074} | Format-Table -Wrap
if($ShowInfo){
# Gets shutdown and restart related events
Get-EventLog System -Newest 10000 | Where EventId -in 41,1074,1076,6005,6006,6008 | Format-Table TimeGenerated,EventId,UserName,Message -AutoSize -wrap #,6013,6009
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment