When did a server boot or restart

If you want to find when a server last rebooted, or a short history of reboots to establish a pattern or cause of a problem you can use the following powershell command.

Get-EventLog -LogName System -After $(Get-Date).AddDays(-1) `
      | Where-Object { $_.EventId -in (6008,6009,6005,6006) }

This searches the System event log (`Get-EventLog -LogName System`) over the specified time period (`AddDays(-1)) for event IDs 6005, 6006, 6008 and 6009. 

These events are:

  • 6005 - The event log service was started.
  • 6006 - The event log service was stopped.
  • 6008 - The previous system shutdown at {Time} on {Date} was unexpected.
  • 6009 - Indicates the Windows product name, version, build number, service pack number, and operating system type detected at boot time

These are generally enough to indicate when, and sometimes why or how, a server was restarted.