Skip to content

Instantly share code, notes, and snippets.

@d4rkeagle65
Created May 21, 2020 14:06
Show Gist options
  • Save d4rkeagle65/c14fe231555813e3f9686ceee5757b22 to your computer and use it in GitHub Desktop.
Save d4rkeagle65/c14fe231555813e3f9686ceee5757b22 to your computer and use it in GitHub Desktop.
Powershell script to get Sleep, Wake, Shutdown, Restart, Wireless/Wired Connection & Disconnect Events from the Eventlog. I will clean this up in the future, but wanted to record it quickly for the moment.
param( $Newest = 10 )
function Parse-EventLogEntry
{
param(
[Parameter(Mandatory=$true, Position=0, ValueFromPipeline=$true)]
[System.Diagnostics.EventLogEntry[]]
$eventInfo
)
Process
{
foreach ($info in $eventInfo)
{
$enterSleep = [DateTime]::Parse($info.ReplacementStrings[0]);
$exitSleep = [DateTime]::Parse($info.ReplacementStrings[1]);
$duration = $exitSleep - $enterSleep
$wakeSource = 'Unknown'
if ($info.Message -match 'Wake Source:\s*(.*)$')
{
$wakeSource = $matches[1]
}
new-object psobject -Property @{Duration = $duration; Sleep = $enterSleep;
Wake = $exitSleep; WakeSource = $wakeSource}
}
}
}
# Sleep/Wake Events
Get-EventLog -LogName System -Source Microsoft-Windows-Power-Troubleshooter -Newest $Newest -ErrorAction SilentlyContinue | Sort TimeGenerated | Parse-EventLogEntry
# Shutdown/Restart Events
Get-EventLog -Logname System -Newest $Newest -Source "USER32" | Select TimeGenerated,Message
# General NIC Events
Get-WinEvent -FilterHashtable @{ProviderName='Microsoft-Windows-NetworkProfile'; id=10000,10001} -MaxEvents $Newest | Select TimeCreated,Message
# Wireless Connection Events
Get-WinEvent -FilterHashtable @{ProviderName='Microsoft-Windows-WLAN-AutoConfig';} -MaxEvents $Newest | Select TimeCreated,Message
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment