1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
|
<#Hi Guys Sharing with you all a script to Find Who Restarted a Server
Copy paste the one liner in an elevated Powershell window on a Clustered Hyper-V host. #>
Get-WinEvent -FilterHashtable @{logname='System'; id=1074} |
ForEach-Object {
$rv = New-Object PSObject | Select-Object Date, User, Action, Process, Reason, ReasonCode, Comment
$rv.Date = $_.TimeCreated
$rv.User = $_.Properties[6].Value
$rv.Process = $_.Properties[0].Value
$rv.Action = $_.Properties[4].Value
$rv.Reason = $_.Properties[2].Value
$rv.ReasonCode = $_.Properties[3].Value
$rv.Comment = $_.Properties[5].Value
$rv
} | Select-Object Date, Action, Reason, User
|
this is a great script however I was wondering if there is anyway that you know of to beable to just parse that last record entry instead of listing every record in the system event log?
Just add -First 1 to the end of the Select-Object