Solved

HOW DO I DISCOVER LAST REBOOT TIME IN WIN NT4?

Posted on 2000-05-08
13
356 Views
Last Modified: 2013-12-28
IS THERE AN EASY WAY TO TELL IF A WINDOWS  NT 4.0 MACHINE HAS BEEN  REBOOTED ? LOOKING AT THE c/a/d SECURITY BOX WILL TELL ME WHEN I LAST LOGGED ON BUT NOT IF THE MACHINE HAS BEEN SHUTDOWN.  

ALSO... IF THIS IS POSSIBLE,  IS THERE A WAY TO  DISTINGUISH BETWEEN A POWEROFF/ON AND A c/a/d SHUTDOWN RESTART IN THE SAME WAY AS MS SCANDISK?

ANY HELP GREATLY APPRECIATED.

THANKS
0
Comment
Question by:KW82
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 3
  • +2
13 Comments
 

Expert Comment

by:khang242
ID: 2789336
search microsoft's site for an uptime.exe, or just load up task manager and look at the cpu time of system idle process, or you can just scan through your event viewer's system log and look for the times event viewer started, since it usually gets loaded up by default
0
 
LVL 95

Accepted Solution

by:
Lee W, MVP earned 50 total points
ID: 2789506
Uptime may work - it depends on what it's basing that on.

If your CPU is ever used, looking at system idle process is by far the least accurate way to do it.

Provided you don't stop and/or restart either the server service or the workstation service, you can type "net statistics workstation" (or "... server") and that will tell you when those service started.

A FAIRLY reliable way is to track event log start and stop messages.  But if that service is stopped and started manually, you'll get an inaccurate reading.

The best way to track this is to go to user manager and enable auditing for "Restart, Shutdown, and System" - This will log an event to the security log every reboot.

As for differentiating between a Warm Boot and a Cold boot, (Power OFF/ON tvs. "Shutdown and Restart" option) unless the security log tells you the exact kind of shutdown done - possible, but I'm not certain - there's no way to tell, short of putting a boot password in BIOS so if anyone reboots it, they can't go any further than the boot-up screen.  But doing this could seriously affect your business if this server is generally required to be up 24x7.
0
 

Expert Comment

by:khang242
ID: 2790304
system idle process has never reached 100 for me, so it's a fairly good estimate, who knows, maybe uptime just calculates that
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 2790362
My point is if you use MS Access or run a distributed computing program such as SETI at home, this eats up CPU cycles which takes away from the Idle process.  For example, on my system, my system Idle process is at 119:47.  But Seti is as 58:46.  Plus various other services and applications total in excess of 45 minutes.  If I close ANY program once it's opened, it causes my time count to be instantly off.  If you add all this time together, my uptime is about 179 hrs 18 minutes.  According to "UpTime" my system has only been on for 4 days 1 hour and 19 minutes (97:19) - which is more accurate - (I have dual CPUs and with each single second or realtime idleness, both CPUs experience it and therefore 1 second is equal to 2.  Now Uptime (from one of the resource kits) appears fairly accurate - according to the workstation service, my system has been up since May 4 at 5:14 pm
0
 

Expert Comment

by:khang242
ID: 2790404
leew: i was wrong, i ran some tests and system idle time does stop when the cpu is fully used

the new uptime 2.0 in windows 2000 is very good, it calculates uptime availability as well, as well as some other useful facts, but it doesn't work for NT4 i don't believe
0
 
LVL 23

Expert Comment

by:Tim Holman
ID: 2791855
Look for the 6005 message in the event viewer - this will tell you when the event log was last started (ie when it was rebooted).
A power on / off will cause a dirty shutdown message in the event log - message ID 6008.
0
 

Expert Comment

by:rwberger
ID: 2794407
The way I do this is to enable "Restart, Shutdown and System" in the audit policy of User Manager.

You'll have to restart your system. This will log event 512 in the system log of the event viwer whenever the system boots.

Ramon Berger
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 2794479
rwberger,

Please reread the comments - you'll find I've already given that as an answer - to be courteous, I did not lock the question by "answering" it so others could also make suggestions.

0
 

Expert Comment

by:rwberger
ID: 2794641
rwberger changed the proposed answer to a comment
0
 

Author Comment

by:KW82
ID: 2795925
Thanks all for valid and helpful contributions, especially "leew."

I am however sure that there must be a way to distinguish between a cold reboot and a CAD shutdown/restart because Windows can tell the difference when it restarts - ie it runs scandisk or it doesn't.

Any ideas anyone??
0
 
LVL 23

Expert Comment

by:Tim Holman
ID: 2801101
I'll try again :

Look for the 6005 message in the event viewer - this will tell you when the event log was last started (ie when it was rebooted).

A power on / off will cause a dirty shutdown message in the event log - message ID 6008.   Every time a dirty shutdown is detected, SCANDISK will be run.

So - 6005 will tell you when there's been a graceful reboot.

6008 will tell you when there's been a power off, or a blue screen (which will be listed in the event viewer as well).
0
 

Author Comment

by:KW82
ID: 2801730
OK, guess I missed that one Tim. Sorry.
0
 
LVL 23

Expert Comment

by:Tim Holman
ID: 2803667
No probs - I thought you may have missed it !
0

Featured Post

Simple, centralized multimedia control

Watch and learn to see how ATEN provided an easy and effective way for three jointly-owned pubs to control the 60 televisions located across their three venues utilizing the ATEN Control System, Modular Matrix Switch and HDBaseT extenders.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
A project that enables an administrator to perform actions within a user session context not just at the time of login but any time later on day(s) or week(s) later.
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question