• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2999
  • Last Modified:

Convert Reg_Binary Data to Date using Powershell

I need some help converting data out of the registry and figuring out what the last shutdown time of the workstation is/was.

I am using the PSRemoteRegistry module to get the value from the remote machine and need to convert it to a readable date.

Please see code below:

Import-Module PSRemoteRegistry

$key = "SYSTEM\CurrentControlSet\Control\Windows"

$data = (get-regbinary -computerName "xxx" -key $key -Value "ShutdownTime").data

Open in new window


The output of this gives me:
2
23
223
209
87
243
205
1

Thanks
0
dhalliday
Asked:
dhalliday
1 Solution
 
John JenningsOwnerCommented:
Use this powershell command instead of the script you've written. It's only one line, and will automatically show you the last registered shutdown event in the System event log.

Get-WinEvent -FilterHashtable @{logname='system';id=6006} -MaxEvents 1

Open in new window


PS - You can add "-ComputerName {nameofremotemachine}" (without quotes) to the snippet above to run it on a remote machine.
0
 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
It's a FileTime structure, constructing a 64 bit integer.
$key = "SYSTEM\CurrentControlSet\Control\Windows"
$data = (get-regbinary -computerName "xxx" -key $key -Value "ShutdownTime").data
$time = [DateTime]::FromFileTime( (((((($data[7]*256 + $data[6])*256 + $data[5])*256 + $data[4])*256 + $data[3])*256 + $data[2])*256 + $data[1])*256 + $data[0])

Open in new window

or
$key = "SYSTEM\CurrentControlSet\Control\Windows"
(get-regbinary -computerName "xxx" -key $key -Value "ShutdownTime").data | foreach-object `
-Begin { $time = 0; $i = 0 } `
-Process { $time += $_ * [math]::Pow(256,$i++) } `
-End { $time = [DateTime]::FromFileTime($time) }

Open in new window

Note that the Registry shutdown time is a few seconds behind the eventlog entry.
0
 
dhallidayAuthor Commented:
Thanks for the quick turn around on the solution.  It worked perfectly.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Tackle projects and never again get stuck behind a technical roadblock.
Join Now