PowerShell and the system event log are perfectly designed for this task. Note. Events with identifier 12 represent the System Start Up event, and identifier 13 represents System Shutdown . The following PowerShell script will provide one-month startup and shutdown times for your system.
echo "Start time:" Get-EventLog System -After 12/21/2011 | ? {$_.EventId -eq 12} | % {$_.TimeGenerated} echo "Shutdown time:" Get-EventLog System -After 12/21/2011 | ? {$_.EventId -eq 13} | % {$_.TimeGenerated}
Substitute 12/21/2011 for any date. Click Start, type powershell, and then type Windows PowerShell.
source share