Solved

Convert Reg_Binary Data to Date using Powershell

Posted on 2013-01-15
3
2,198 Views
Last Modified: 2013-01-16
I need some help converting data out of the registry and figuring out what the last shutdown time of the workstation is/was.

I am using the PSRemoteRegistry module to get the value from the remote machine and need to convert it to a readable date.

Please see code below:

Import-Module PSRemoteRegistry

$key = "SYSTEM\CurrentControlSet\Control\Windows"

$data = (get-regbinary -computerName "xxx" -key $key -Value "ShutdownTime").data

Open in new window


The output of this gives me:
2
23
223
209
87
243
205
1

Thanks
0
Comment
Question by:dhalliday
3 Comments
 
LVL 7

Expert Comment

by:JohnThePro
Comment Utility
Use this powershell command instead of the script you've written. It's only one line, and will automatically show you the last registered shutdown event in the System event log.

Get-WinEvent -FilterHashtable @{logname='system';id=6006} -MaxEvents 1

Open in new window


PS - You can add "-ComputerName {nameofremotemachine}" (without quotes) to the snippet above to run it on a remote machine.
0
 
LVL 68

Accepted Solution

by:
Qlemo earned 500 total points
Comment Utility
It's a FileTime structure, constructing a 64 bit integer.
$key = "SYSTEM\CurrentControlSet\Control\Windows"
$data = (get-regbinary -computerName "xxx" -key $key -Value "ShutdownTime").data
$time = [DateTime]::FromFileTime( (((((($data[7]*256 + $data[6])*256 + $data[5])*256 + $data[4])*256 + $data[3])*256 + $data[2])*256 + $data[1])*256 + $data[0])

Open in new window

or
$key = "SYSTEM\CurrentControlSet\Control\Windows"
(get-regbinary -computerName "xxx" -key $key -Value "ShutdownTime").data | foreach-object `
-Begin { $time = 0; $i = 0 } `
-Process { $time += $_ * [math]::Pow(256,$i++) } `
-End { $time = [DateTime]::FromFileTime($time) }

Open in new window

Note that the Registry shutdown time is a few seconds behind the eventlog entry.
0
 

Author Closing Comment

by:dhalliday
Comment Utility
Thanks for the quick turn around on the solution.  It worked perfectly.
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Join & Write a Comment

In this previous article (https://oddytee.wordpress.com/2016/05/05/provision-new-office-365-user-and-mailbox-from-exchange-hybrid-via-powershell/), we made basic license assignments to users in O365. When I say basic, the method is the simplest way …
Synchronize a new Active Directory domain with an existing Office 365 tenant
This Micro Tutorial will teach you how to change your appearance and customize your Windows 7 interface to your unique preference. This will be demonstrated using Windows 7 operating system.
This Micro Tutorial will go in depth within Systems and Security in Windows 7 and will go into detail regarding Action Center, Windows Firewall, System, etc. This will be demonstrated using Windows 7 operating system.

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now