Any way to see how last reboot was executed?

Question

I am trying to get some information out of my system with the ManagementObjectSearcher. I managed to get my last reboot time with this code:

private String getLastRebootTime()
    {
        DateTime bootTime = new DateTime();
        ManagementObjectSearcher mos1 = new System.Management.ManagementObjectSearcher(@"\\.\root\CIMV2", "SELECT LastBootUpTime FROM Win32_OperatingSystem WHERE Primary='true'");
        foreach (ManagementObject mo in mos1.Get())
        {
            bootTime =
            ManagementDateTimeConverter.ToDateTime(mo.Properties["LastBootUpTime"].Value.ToString());
        }
        return bootTime.ToString();
    }

I now want to know if it is possible to get info about how the last reboot was executed. For example if it was a manual reboot or a dirty reboot.

score 1 · Accepted Answer · edited May 23 '17 at 12:21

1

Check both this answer and the comments for it on how to search the logs. They were looking for the last time stamp, but the comments appear to provide the solution you need as well.

I think you are looking for:

Log = "System"
Source = "EventLog"
Filter EventLogEntry for EventID == 6008

edited May 23 '17 at 12:21

Community

1
1

answered Jul 29 '15 at 14:42

Martin Noreke

4,066
22
34

I am not looking for the last reboot time, that one works. I am looking for a way to see if the last reboot was executed mannualy by a person clicking the shutdown button or if it was a dirty shutdown(for example: holding the power button) – Tomdeboer Jul 29 '15 at 14:45
Hard reset your machine and look for the *unexpeted shutdown* event that should appear in the log on the next boot – Alex K. Jul 29 '15 at 15:01
Which is the EventID 6008 I was eluding to in my response. – Martin Noreke Jul 29 '15 at 18:24
1

got it by changing the select statement in above example code to "SELECT * FROM Win32_NTLogEvent WHERE EventCode=6008". Thanks Martin – Tomdeboer Jul 30 '15 at 07:26

Any way to see how last reboot was executed?

1 Answers1