Solved

Convert Reg_Binary Data to Date using Powershell

Posted on 2013-01-15
3
2,258 Views
Last Modified: 2013-01-16
I need some help converting data out of the registry and figuring out what the last shutdown time of the workstation is/was.

I am using the PSRemoteRegistry module to get the value from the remote machine and need to convert it to a readable date.

Please see code below:

Import-Module PSRemoteRegistry

$key = "SYSTEM\CurrentControlSet\Control\Windows"

$data = (get-regbinary -computerName "xxx" -key $key -Value "ShutdownTime").data

Open in new window


The output of this gives me:
2
23
223
209
87
243
205
1

Thanks
0
Comment
Question by:dhalliday
3 Comments
 
LVL 7

Expert Comment

by:JohnThePro
ID: 38780567
Use this powershell command instead of the script you've written. It's only one line, and will automatically show you the last registered shutdown event in the System event log.

Get-WinEvent -FilterHashtable @{logname='system';id=6006} -MaxEvents 1

Open in new window


PS - You can add "-ComputerName {nameofremotemachine}" (without quotes) to the snippet above to run it on a remote machine.
0
 
LVL 68

Accepted Solution

by:
Qlemo earned 500 total points
ID: 38780601
It's a FileTime structure, constructing a 64 bit integer.
$key = "SYSTEM\CurrentControlSet\Control\Windows"
$data = (get-regbinary -computerName "xxx" -key $key -Value "ShutdownTime").data
$time = [DateTime]::FromFileTime( (((((($data[7]*256 + $data[6])*256 + $data[5])*256 + $data[4])*256 + $data[3])*256 + $data[2])*256 + $data[1])*256 + $data[0])

Open in new window

or
$key = "SYSTEM\CurrentControlSet\Control\Windows"
(get-regbinary -computerName "xxx" -key $key -Value "ShutdownTime").data | foreach-object `
-Begin { $time = 0; $i = 0 } `
-Process { $time += $_ * [math]::Pow(256,$i++) } `
-End { $time = [DateTime]::FromFileTime($time) }

Open in new window

Note that the Registry shutdown time is a few seconds behind the eventlog entry.
0
 

Author Closing Comment

by:dhalliday
ID: 38782818
Thanks for the quick turn around on the solution.  It worked perfectly.
0

Featured Post

Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Create and license users in Office 365 in bulk based on a CSV file. A step-by-step guide with PowerShell script examples.
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This Micro Tutorial will go in depth within Systems and Security in Windows 7 and will go into detail regarding Action Center, Windows Firewall, System, etc. This will be demonstrated using Windows 7 operating system.
The viewer will learn how to successfully download and install the SARDU utility on Windows 7, without downloading adware.

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now