Get History of Server Reboots

By Denis Molodtsov

Published in PowerShell

December 17, 2025

1 min read

Get History of Server Reboots

Conclusion

Get History of Server Reboots

I frequently have to work on file shares and SharePoint server migrations to Microsoft 365. It is very common for my migration jobs to be interrupted by sudden reboots. I created this one-liner PowerShell script to quickly get the history of the last 10 reboots.

powershell

((Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TerminalServices-LocalSessionManager/Operational';ID=23} -MaxEvents 10 -EA 0)+(Get-WinEvent -FilterHashtable @{LogName='System';ID=1074,6008,41} -MaxEvents 10 -EA 0))|Sort-Object TimeCreated -Descending|Select-Object TimeCreated,Id,@{N='Event';E={switch($_.Id){23{'Session Logoff'}1074{'Planned Reboot/Shutdown'}6008{'Unexpected Shutdown'}41{'Kernel Power Failure'}default{$_.Id}}}},@{N='Details';E={$_.Message.Split('.')[0]}}|Format-Table -Wrap

In this script, the IDs are the Windows Event IDs:

ID	Log	Meaning
23	TerminalServices-LocalSessionManager	Session logoff (user disconnected/logged off from RDP)
1074	System	Planned shutdown/restart initiated by a user or process
6008	System	Unexpected shutdown (system was not cleanly shut down)
41	System	Kernel-Power failure (system rebooted without clean shutdown, often power loss or crash)

Conclusion

This one-liner PowerShell script is a quick and effective way to get the history of server reboots, helping you identify any unexpected interruptions during your migration tasks.