Created
May 21, 2020 14:06
-
-
Save d4rkeagle65/c14fe231555813e3f9686ceee5757b22 to your computer and use it in GitHub Desktop.
Powershell script to get Sleep, Wake, Shutdown, Restart, Wireless/Wired Connection & Disconnect Events from the Eventlog. I will clean this up in the future, but wanted to record it quickly for the moment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| param( $Newest = 10 ) | |
| function Parse-EventLogEntry | |
| { | |
| param( | |
| [Parameter(Mandatory=$true, Position=0, ValueFromPipeline=$true)] | |
| [System.Diagnostics.EventLogEntry[]] | |
| $eventInfo | |
| ) | |
| Process | |
| { | |
| foreach ($info in $eventInfo) | |
| { | |
| $enterSleep = [DateTime]::Parse($info.ReplacementStrings[0]); | |
| $exitSleep = [DateTime]::Parse($info.ReplacementStrings[1]); | |
| $duration = $exitSleep - $enterSleep | |
| $wakeSource = 'Unknown' | |
| if ($info.Message -match 'Wake Source:\s*(.*)$') | |
| { | |
| $wakeSource = $matches[1] | |
| } | |
| new-object psobject -Property @{Duration = $duration; Sleep = $enterSleep; | |
| Wake = $exitSleep; WakeSource = $wakeSource} | |
| } | |
| } | |
| } | |
| # Sleep/Wake Events | |
| Get-EventLog -LogName System -Source Microsoft-Windows-Power-Troubleshooter -Newest $Newest -ErrorAction SilentlyContinue | Sort TimeGenerated | Parse-EventLogEntry | |
| # Shutdown/Restart Events | |
| Get-EventLog -Logname System -Newest $Newest -Source "USER32" | Select TimeGenerated,Message | |
| # General NIC Events | |
| Get-WinEvent -FilterHashtable @{ProviderName='Microsoft-Windows-NetworkProfile'; id=10000,10001} -MaxEvents $Newest | Select TimeCreated,Message | |
| # Wireless Connection Events | |
| Get-WinEvent -FilterHashtable @{ProviderName='Microsoft-Windows-WLAN-AutoConfig';} -MaxEvents $Newest | Select TimeCreated,Message |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment