Solved

Convert Reg_Binary Data to Date using Powershell

Posted on 2013-01-15
3
2,311 Views
Last Modified: 2013-01-16
I need some help converting data out of the registry and figuring out what the last shutdown time of the workstation is/was.

I am using the PSRemoteRegistry module to get the value from the remote machine and need to convert it to a readable date.

Please see code below:

Import-Module PSRemoteRegistry

$key = "SYSTEM\CurrentControlSet\Control\Windows"

$data = (get-regbinary -computerName "xxx" -key $key -Value "ShutdownTime").data

Open in new window


The output of this gives me:
2
23
223
209
87
243
205
1

Thanks
0
Comment
Question by:dhalliday
3 Comments
 
LVL 7

Expert Comment

by:JohnThePro
ID: 38780567
Use this powershell command instead of the script you've written. It's only one line, and will automatically show you the last registered shutdown event in the System event log.

Get-WinEvent -FilterHashtable @{logname='system';id=6006} -MaxEvents 1

Open in new window


PS - You can add "-ComputerName {nameofremotemachine}" (without quotes) to the snippet above to run it on a remote machine.
0
 
LVL 69

Accepted Solution

by:
Qlemo earned 500 total points
ID: 38780601
It's a FileTime structure, constructing a 64 bit integer.
$key = "SYSTEM\CurrentControlSet\Control\Windows"
$data = (get-regbinary -computerName "xxx" -key $key -Value "ShutdownTime").data
$time = [DateTime]::FromFileTime( (((((($data[7]*256 + $data[6])*256 + $data[5])*256 + $data[4])*256 + $data[3])*256 + $data[2])*256 + $data[1])*256 + $data[0])

Open in new window

or
$key = "SYSTEM\CurrentControlSet\Control\Windows"
(get-regbinary -computerName "xxx" -key $key -Value "ShutdownTime").data | foreach-object `
-Begin { $time = 0; $i = 0 } `
-Process { $time += $_ * [math]::Pow(256,$i++) } `
-End { $time = [DateTime]::FromFileTime($time) }

Open in new window

Note that the Registry shutdown time is a few seconds behind the eventlog entry.
0
 

Author Closing Comment

by:dhalliday
ID: 38782818
Thanks for the quick turn around on the solution.  It worked perfectly.
0

Featured Post

Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Utilizing an array to gracefully append to a list of EmailAddresses
This article will help you understand what HashTables are and how to use them in PowerShell.
This Micro Tutorial will go in depth within Systems and Security in Windows 7 and will go into detail regarding Action Center, Windows Firewall, System, etc. This will be demonstrated using Windows 7 operating system.
This Micro Tutorial will give you a basic overview of Windows DVD Burner through its features and interface. This will be demonstrated using Windows 7 operating system.

786 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question