如何找到特定日期计算机的首次开机时间和最后关机时间？

Question

我需要查找计算机第一次启动和最后一次关闭的时间。

例如。我会在早上 10 点启动我的计算机，并且我会多次重新启动或处于闲置状态。最后在一天结束时（晚上 9 点）我会关闭机器。

我想知道过去 2 周我在电脑前大致花费了多长时间。

下面的命令在事件日志消息中给出了一天的正常运行时间，但它显示了以秒为单位的多个正常运行时间。相反，如果我可以获得首次启动时间和最后一次关闭时间，我可以轻松计算出来。

(get-eventlog -EntryType Information -LogName System -InstanceId 2147489661 -newest 25)

Answer 1

我会从系统事件日志中获取事件。我可能会使用内核启动和停止时间：

## 12 is a startup
## 13 is a shutdown
Get-EventLog -LogName 'System' `
    -InstanceID 12, 13 `
    -Source 'Microsoft-Windows-Kernel-General' `
| Select InstanceID, TimeGenerated `
| sort TimeGenerated

我会将启动时间与下一次找到的关机时间进行比较。既然你只是问在哪里可以找到时间，我就到此为止。您还可以从 systeminfo.

获取启动时间

Answer 2

如何获取每天的第一个和最后一个日志条目
前提是电脑关机且只有一个用户。

此脚本获取前 10 天的第一个最后一个日志条目之间的时间跨度：

    -1..-10 | ForEach {
    $When =  (Get-Date).AddDays($_)
    $After =  Get-Date $When  -Hour 0  -Minute 0  -Second 0
    $Before = Get-Date $When  -Hour 23 -Minute 59 -Second 59
    $DayEvents =(Get-Eventlog -Entrytype Information -Logname System -After $After -Before $Before).TimeGenerated
    if($dayevents -ne $null) {
        $Span = New-Timespan -Start ($DayEvents | Select -Last 1) -End ($DayEvents | Select -First 1)
        "Your computer worked hard on {0} - for {1}:{2}:{3} hours" -F $When.ToString('yyyy-MM-dd'),$Span.Hours,$Span.Minutes,$Span.Seconds
    }
    else
    {
        $msg = "Holiday for your computer on {0}. It is not powered on" -F $When.ToString('yyyy-MM-dd') 
        Write-host $msg -foregroundcolor green
    }
}

示例输出

Your computer worked hard on 2018-04-19 - for 12:5:22 hours
Your computer worked hard on 2018-04-18 - for 8:38:51 hours
Your computer worked hard on 2018-04-17 - for 9:25:5 hours
Your computer worked hard on 2018-04-16 - for 10:36:36 hours
Holiday for your computer on 2018-04-15. It is not powered on
Your computer worked hard on 2018-04-14 - for 14:55:7 hours
Your computer worked hard on 2018-04-13 - for 13:47:32 hours
Your computer worked hard on 2018-04-12 - for 13:3:19 hours
Your computer worked hard on 2018-04-11 - for 12:35:29 hours
Your computer worked hard on 2018-04-10 - for 10:37:51 hours

Answer 3

我用之前的代码得到了最后7天的最后开机和关机时间，

我重命名了 InstanceID 和 TableHeaders 以使结果更清晰：

0..-7 | ForEach {
$When =  (Get-Date).AddDays($_)
$After =  Get-Date $When  -Hour 0  -Minute 0  -Second 0
$Before = Get-Date $When  -Hour 23 -Minute 59 -Second 59

Get-EventLog -LogName 'System' -InstanceID 12, 13 -After $After -Before $Before -Source 'Microsoft-Windows-Kernel-General'`
| Select @{Name = ’Action’; Expression = {$_.InstanceID -replace '12','Power ON' -replace '13','Power OFF'}}, @{Name = ’Date’; Expression = {$_.TimeGenerated}}`
| Format-Table -AutoSize
}

如何找到特定日期计算机的首次开机时间和最后关机时间？

how to find first boot time and last shut down time of computer in a particular day?

windows

powershell

wmi

batch-file