wevtutil

[sm625]

I'm looking for a wevtutil command line string (or equivalent command line string) that will return me the last shutdown time for my pc. Anyone know it?

 

[Dahak]

I have not used this personally but did find the following post at technet

that had the command that you are looking for

wevtutil qe system "/q:*[System[EventID=1074]] /f:text /rd:true /c:1

if you want to a txt file you can add > c: \path to file\filename.txt

 

[sm625]

wevtutil qe system "/q:*[System[EventID=10774]]" /f:text /rd:true /c:1 > wevdata.txt

results in a wevdata.txt file with 0 bytes

 

[sm625]

lol its actually 1074. Thanks.

 

[Dahak]

whoops, what I get for typing it out instead of direct copy, I will fix the original post to in case anyone comes across it