Windows 10 Boot Time and Uptime: PowerShell Insights

Published:13 August 2019 - 6 min. read

Nathan Kasco Image

Nathan Kasco

Read more tutorials by Nathan Kasco!

Azure Cloud Labs: these FREE, on‑demand Azure Cloud Labs will get you into a real‑world environment and account, walking you through step‑by‑step how to best protect, secure, and recover Azure data.

Windows uptime is a measurement that many server administrators use to troubleshoot day-to-day issues that may arise in the environment. In this article, you’re going to learn how to check boot time in Windows 10 and Windows Server. You’re free to use whichever way is easiest for you. Use this article as a future reference.

The article will be broken up into two main parts; checking server uptime and finding historical Windows uptime. The first part will focus on finding how much time the computer has been up since its last reboot. This is called “current” uptime in this article.

The second part of the article will focus on finding “historical” uptime meaning a reboot on how long a Windows system was up between multiple reboots. Using PowerShell, you’ll learn how to parse the Windows event log to pull historical uptime numbers.

How to Check Boot Time in Windows 10 and Windows Server

To get started, let’s now jump into a few different ways to find the current Windows uptime.

You’ll be seeing a demonstration of how to check boot time in Windows 10 by running commands locally on a Windows system through this section. But know that by using PowerShell Remoting, you can also perform these checks remotely (excluding task manager).

Task Manager

One of the most simple and straightforward ways to find uptime is to simply open Task Manager.

To check Windows uptime with Task Manager, right-click the Windows taskbar and select Task Manager or press CtrlShiftEsc. Once Task Manager is open, click on the Performance tab. Under the Performance tab, you will see a label of Up Time.

Finding Windows uptime with task manager
Finding Windows uptime with task manager

Event Viewer

Event Viewer is very commonly used by most sysadmins on a regular basis, which makes it a great option for a non-command line-related method of retrieving uptime. Event ID 6005 and 6006 can be used to identify when the event log service starts or stops, which occurs during boot/shut downtimes. Follow these steps to identify uptime via Event Viewer:

  • Bring up the Start Menu and simply search for Event Viewer, you can also get to it via Computer Management.
  • On the left, expand the Windows Logs section and select System
  • Now that we are querying only System related events, click “Filter Current Log…” on the right hand side of your window
  • In the Event ID field (by default this will be prefilled with text stating “All Event IDs”) we need to search for our applicable Event IDs, type “6005, 6006” then click OK

You can then compare the two times to create a total uptime. Also, since many instances of these events are stored, we can query the history of uptimes!

You now have filtered Event Logs that will show you not only the last time but all known times in which there has been a bootup/shut down.

PowerShell

PowerShell has a few different ways you can retrieve uptime. You can either query WMI or use the Windows event log.

When querying WMI, you can query the Win32_OperatingSystem class and select the LastBootUpTime property as shown below.

PS51> Get-CimInstance Win32_OperatingSystem | Select-Object LastBootUpTime

LastBootUpTime      
--------------      
9/25/2019 9:37:37 PM

To query the Event Log via PowerShell, use the Get-WinEvent cmdlet. You’ll need to search for event IDs 6005 or 6006 that indicate the last time the machine was started.

PS51> Get-WinEvent -ProviderName EventLog | Where-Object {$_.Id -eq 6005 -or $_.Id -eq 6006} | Select-Object -First 1 TimeCreated

TimeCreated         
-----------         
9/25/2019 9:37:52 PM

WMIC

WMIC provides a command-line interface for WMI and is a tried and true method that has been used for many years. To query via uptime via WMIC you query the Win32_OperatingSystem WMI class again although a bit under the covers. You can see below you can use the WMIC syntax os get lastbootuptime to return the last time the server was started.

> wmic os get lastbootuptime

LastBootUpTime             

20190925213737.500000-240

You do not have to download anything to leverage WMIC, as it comes pre-installed with Windows.

System Information Utility

The systeminfo command displays detailed configuration info about a computer and can be used to query system uptime. By using the built-in find command line tool you can parse the text to retrieve the data you need.

Simply open up either Command Prompt or PowerShell and type systeminfo | find.

> systeminfo | find "System Boot Time:"

System Boot Time:          9/25/2019, 9:37:37 PM

You do not have to download anything to leverage systeminfo, as it comes pre-installed with Windows.

Net Statistics Command

You can also quickly query uptime via Net Statistics or more commonly known as net stats. The net stats command returns general information about your session. You can see below the Statistics since… line. This date indicates when the machine was started.

> net stats srv

Workstation Statistics for \\NATES-PC


Statistics since 9/25/2019 9:37:52 PM

--SNIP--

The command completed successfully.

Uptime Command

If you need a small, portable utility to find Windows uptime, look no further than NeoSmart Technologies’ Uptime command for Windows. This utility is perfect for quickly querying uptime on any Windows version. The major benefit of this tool is the convenience factor. If you find yourself using this many times per day you may want to consider this method.

After downloading the tool, extract uptime.exe to %WinDir%\System32. Then open up a command prompt and simply type uptime.

Uptime tool
Uptime tool

To run this tool remotely, you’d first need to copy the tool to the Windows systems you’re checking uptime on.

Introducing the Get-ServerUptimeReport script

So you don’t have to write the PowerShell yourself, download a community script called Get-ServerUptimeReport.ps1.

PS51> Install-Script -Name Get-ServerUptimeReport

This script allows you to provide a computer name as a parameter. It will then parse the System event log of the computer and find both a start and stop event to compare the two. It will then return the total time the server was online until the event log has rolled.

Below is an example of using this script on a server. It will return the total uptime for all of the events the server has in the event log, including the current uptime.

PS51> ./Get-ServerUptimeReport.ps1 -ComputerName sqlsrv1

Startup Shutdown Uptime (Days) Uptime (Min)
------- -------- ------------- ------------
9/16/2017 12:40:00 PM 9/22/2017 4:20:11 PM 6.15 8860.18
9/16/2017 10:22:49 AM 9/16/2017 12:22:36 PM 0.08 119.79
9/16/2017 3:22:12 PM 9/22/2017 4:20:11 PM 6.04 8697.98

Finding Windows Uptime Across Many Servers

This script is a quick way to find the uptime of a single server across many days. But what if you need this information for lots of servers at once? To do this, you can gather up a list of servers and then pass each computer name, one at a time, to this script.

As an example, define all your servers in an array in the PowerShell console. In this example, the variable array will be called $servers.

In reality, though, you might be pulling server names from Active Directory, Hyper-V, or a text file. As long as you can build an array of server names, you’re fine.

Define all the server names and then iterate over each one with a loop, as shown below.

$servers = 'WEBSRV1','SQLSRV1'
foreach ($server in $servers) {
	Get-ServerUptimeReport.ps1 -ComputerName $server
}

Startup Shutdown Uptime (Days) Uptime (Min)
------- -------- ------------- ------------
9/16/2017 12:45:48 PM 9/22/2017 4:25:39 PM 6.15 8859.86
9/16/2017 10:42:52 AM 9/16/2017 12:42:34 PM 0.08 119.7
9/16/2017 2:42:17 PM 9/22/2017 4:25:39 PM 6.07 8743.38
9/16/2017 12:40:00 PM 9/22/2017 4:25:39 PM 6.16 8865.65
9/16/2017 10:22:49 AM 9/16/2017 12:22:36 PM 0.08 119.79
9/16/2017 3:22:12 PM 9/22/2017 4:25:39 PM 6.04 8703.46

This code works, but you can’t determine which server each row references. Add a server name to the output like below using a calculated property.

$servers = 'WEBSRV1','SQLSRV1'
foreach ($server in $servers) {
	Get-ServerUptimeReport.ps1 -ComputerName $server | Select-Object -Property *,@{n='ServerName';e={$server}}
}

Startup Shutdown Uptime (Days) Uptime (Min) ServerName
------- -------- ------------- ------------ ----------
9/16/2017 12:45:48 PM 9/22/2017 4:34:59 PM 6.16 8869.19 WEBSRV1
9/16/2017 10:42:52 AM 9/16/2017 12:42:34 PM 0.08 119.7 WEBSRV1
9/16/2017 2:42:17 PM 9/22/2017 4:34:59 PM 6.08 8752.71 WEBSRV1

Startup Shutdown Uptime (Days) Uptime (Min) ServerName
------- -------- ------------- ------------ ----------
9/16/2017 12:40:00 PM 9/22/2017 4:35:01 PM 6.16 8875.01 SQLSRV1
9/16/2017 10:22:49 AM 9/16/2017 12:22:36 PM 0.08 119.79 SQLSRV1
9/16/2017 3:22:12 PM 9/22/2017 4:35:01 PM 6.05 8712.81 SQLSRV1

We now have an excellent little tool that can provide us a quick report on uptime for our servers over time!

Summary

You’ve now seen many different ways to find Windows uptime. Regardless of which option you choose, you’ll receive the same information. Choose the best one for your own context.

And remember if you need a historical report of uptime history, don’t forget about the Get-ServerUptimeReport PowerShell script!

Hate ads? Want to support the writer? Get many of our tutorials packaged as an ATA Guidebook.

Explore ATA Guidebooks

Looks like you're offline!