gwmi win32_ntlogevent -filter "LogFile='System' and EventCode='1074' and Message like '%restart%'" |select User,@{n="Time";e={$_. ConvertToDateTime($_.TimeGenerated)}}</pre> <pre class="toolbar-overlay:false lang:ps decode:true ">$BootTime = (systeminfo | find "System Boot Time:").Replace("System Boot Time:","").Trim() $BootTime $Uptime = (Get-Date) - [datetime]$BootTime $Uptime