Tuesday, April 26, 2016

Powershell - Who rebooted my server?

If you work in a shared environment with multiple users having access and rights to your servers it is always good to be able to show who rebooted the server last. Here is a quick script to show you just that.

I like to run the script from the server because I don't always have rights with my account, but always have a service account that can access the server.
#Built by Todd Palecek
#To check who rebooted server

#Define current computer name
#Leave as hostname to return current PC or change if want to evaluate different PC
$ServerName = hostname

#Print server being checked
print $ServerName

get-eventlog -logname system -computername $ServerName| where {$_.Source -eq 'USER32'} | select TimeGenerated, UserName

No comments:

Post a Comment