Windows - recording shut-down times

[Jim Sims]

On Feb 20, 2009, at 11:20 AM, Luis wrote:

> Hiya,
>
> You could parse the Event Log ('eventvwr' on the command line) and  
> check for Event ID 6005, which has the start time for the Event Log.
> Not too sure if 6006 or 6008 indicates when it has stopped, although  
> I think you'd only need the start time and work out the rest from  
> there.
> Event ID 6009 should time with the start of the Event Log, and also  
> includes the Windows version info, it that's of any use...
>
> The PsTools from Microsoft have the 'psloglist' command line tool  
> that give you access to remote machines and includes authentication  
> access (can also dump the file to the server).
>
> Another option is to use the built in script: cscript %systemroot% 
> \system32\eventquery.vbs
> Append '-?' (without the quotes!) to get the switches. You'll find  
> in there several formats for the output file.

Thanks a bunch Luis!  Look like great tips for this OS X user who only  
occasionally uses Windows.

sims