Powershell – Query windows restart event on a remote computer 

Get-WinEvent -ComputerName HOST009 -FilterHashtable @{logname='System';id=1074}| Format-Table –wrap 

If we want to get events from multiple PC  

PS C:\> $computers = "Server1","Server2" 
PS C:\> $computers | ForEach-Object {Get-WinEvent -ComputerName $_  -FilterHashtable @{logname = 'System'; id = 1074} -MaxEvents 2 | format-table -wrap} 

If we want to see multiple eventids on the device, we can just add the eventids seperated by comma 

PS C:\> Get-WinEvent -FilterHashtable @{logname = 'System'; id = 1074, 6005, 6006, 6008} -MaxEvents 6 | Format-Table –wrap 

Leave a Reply

Your email address will not be published. Required fields are marked *