Friday, October 11, 2013

Find Operating System Start time using Powershell.

Today, I have been asked  to do a strange task, My manager told me to find a Operating System Start time.

I was thinking about an half hour  on how to get this done, then i thought about Event Logs, every thing is recorded there, after a few minutes of hardworking , i have found the event which tells us about the Start time of the Operating System.

He wants a history of  start up time of all dates, and luckily windows keep history of start up time in Event Logs.

The Event ID : 12, shows a information on at what time the Operating system was  started.

11-10-2013 17-23-24
and we know how to use Powershell and  how to use Get-EventLog cmdlet.
and then it a matter of few seconds , and I have the list of Operating System’s start time.
run the below command to get the list of start time of the operating system.

Get-EventLog -Log System  |  Where {  $_.EventID -eq 12    } | Select TimeGenerated

Here is the result.

11-10-2013 20-15-13
Happy Weekend. Have fun :) .

Aman Dhally
clip_image001 clip_image002 clip_image003 clip_image005  clip_image007


  1. I might recommend WMI for this information. Event logs can be deleted after all.


    1. Hi Ferreter

      Thanks for the comments,

      Yes we can use WMI too,

      Actually i depends on the environment, in Our we do event logs for a long time :) and these is always more then one way

      Thanks and Welcome to the blog.