批处理之家's Archiver

victorwoo 发表于 2014-8-25 09:54

PowerShell 技能连载 - 获取关机信息

原始链接:[url=http://blog.vichamp.com/powershell/tip/2014/08/20/getting-shutdown-information-testing/]PowerShell 技能连载 - 获取关机信息[/url]
发表日期:2014-08-20
[hr]
[i]适用于 PowerShell 所有版本[/i]

Windows 在系统事件日志中记录了所有的关机事件。您可以从那儿提取和分析信息。

以下是一个读取适当的事件日志记录、从 ReplacementStrings 数组中读取相关的信息,并以对象数组的方式返回关机信息的函数。[code]
function Get-ShutdownInfo
{

  Get-EventLog -LogName system -InstanceId 2147484722 -Source user32 |
  ForEach-Object {

    $result = 'dummy' | Select-Object -Property ComputerName, TimeWritten, User, Reason, Action, Executable

    $result.TimeWritten = $_.TimeWritten
    $result.User = $_.ReplacementStrings[6]
    $result.Reason = $_.ReplacementStrings[2]
    $result.Action = $_.ReplacementStrings[4]
    $result.Executable = Split-Path -Path $_.ReplacementStrings[0] -Leaf
    $result.ComputerName = $_.MachineName

    $result
  }
}
[/code]现在要检查关机问题就容易多了:[code]
PS> Get-ShutdownInfo |  Out-GridView
[/code]本文国际来源:[url=http://powershell.com/cs/blogs/tips/archive/2014/08/20/getting-shutdown-information-testing.aspx]Getting Shutdown Information[/url]

页: [1]

Powered by Discuz! Archiver 7.2  © 2001-2009 Comsenz Inc.