Windows - recording shut-down times

Jim Sims sims at
Fri Feb 20 05:35:15 EST 2009

On Feb 20, 2009, at 11:20 AM, Luis wrote:

> Hiya,
> You could parse the Event Log ('eventvwr' on the command line) and  
> check for Event ID 6005, which has the start time for the Event Log.
> Not too sure if 6006 or 6008 indicates when it has stopped, although  
> I think you'd only need the start time and work out the rest from  
> there.
> Event ID 6009 should time with the start of the Event Log, and also  
> includes the Windows version info, it that's of any use...
> The PsTools from Microsoft have the 'psloglist' command line tool  
> that give you access to remote machines and includes authentication  
> access (can also dump the file to the server).
> Another option is to use the built in script: cscript %systemroot% 
> \system32\eventquery.vbs
> Append '-?' (without the quotes!) to get the switches. You'll find  
> in there several formats for the output file.

Thanks a bunch Luis!  Look like great tips for this OS X user who only  
occasionally uses Windows.


More information about the Use-livecode mailing list