Function Get-ComputerUptimeHistory {
$q='
<QueryList>
<Query Id="0" Path="System">
<Select Path="System">*[System[(EventID=12 or EventID=13)]]</Select>
</Query>
</QueryList>'
$events = Get-WinEvent -FilterXml $q
$i=-1
while ( $i+1 -lt $events.length ) {
if($i -eq -1)
{
[PSCustomObject]@{
StartTime = $events[0].TimeCreated;
StopTime = $null ;
UpTime = [datetime]::Now - $events[0].TimeCreated
}
}
else{
[PSCustomObject]@{
StartTime = $events[$i+1].TimeCreated;
StopTime = $events[$i].TimeCreated ;
UpTime = $events[$i].TimeCreated - $events[$i+1].TimeCreated
}
}
$i += 2
}
}
Get-ComputerUptimeHistory | ft -AutoSize >c:\aaa.txt
结果运行结果
Name Value ---- ----- UpTime 12:14:49.7832892 StopTime StartTime 2018-01-19 07:53:39 UpTime 03:06:09.3130450 StopTime 2018-01-18 18:08:17 StartTime 2018-01-18 15:02:08 UpTime 13:48:06.0500843