Also IIRC it reports in UTC so the disparity should match your time zone offset.
Just had another look at uptime and it is reporting in the local timezone, (even though it can't identify it):
But as I was matching up times trying to see the discrepancies I noticed the filter I made wasn't giving system boot events NOTE:
This is for Windows 7.
Anyway, the new improved filter:
Sources: EventLog, Kernel-Boot, Kernel-BootDiagnostics, Kernel-General, Kernel-Power, Power-Troubleshooter,USER32
Event IDs: 1,12,13,41,42,109,1073,1074,6008
Event Level: Critical, Error, Warning, Information
The Event IDs were picked out of my Event Log from power events, etc - some Event IDs mean more than one thing depending on the source, eg. Event ID 1
Source: Kernel-General = System time has changed
Source: Power-Troubleshooter = The system has resumed from Sleep
You could refine the xml so that certain Event IDs only pertain to specific sources but I didn't see enough clashes to warrant the effort, (on my machine anyway).
Short list of what the Event IDs are, (pertaining to startup/shutdown):
|Event ID||Event Type||Event Source||Event|
|1||INFORMATION||Power-Troubleshooter||The system has resumed from Sleep|
|12||INFORMATION||Kernel-General||The operating system started at system time|
|13||INFORMATION||Kernel-General||The operating system is shutting down at system time|
|41||CRITICAL||Kernel-Power||The system has rebooted without cleanly shutting down first.|
|42||INFORMATION||Kernel-Power||The system is entering sleep.|
|109||INFORMATION||Kernel-Power||The kernel power manager has initiated a shutdown transition.|
|1073||WARNING||USER32||The attempt by user <user> to restart/shutdown computer <computername> failed|
|1074||INFORMATION||USER32||The process <processname> has initiated the power off of computer <computername> on behalf of user <user> for the following reason: ...|
|6008||ERROR||EventLog||The previous system shutdown at <time> on <date> was unexpected.|
If I find any more I'll add them.Added:
Event ID 6008
Also, over on p0w3rsh3ll
there's a PowerShell script to retrieve the reboot history
of Win7, (and Win 2008 R2), computers. Providing you have the same login credentials on other computers on the network, it can get those too.
I've attached it below, you'd need to modify it to accept parameters or edit to add in other computer names, (hey, I'm lazy), as it'll just do the localhost if you currently run it.