BGINFO Shutdown Reason

It'll be a bit tricky, so you'll have to fiddle a bit.  Info from last shutdown is stored in the event log, so you'll have to set up a Custom field to display the event log info.  To do that, press Custom... and select WMI Query.  Try using Win32_NTLogEvent, that'll get you access to the event log.  From there, you'll have to isolate what you want to show (and not show), which I would recommend experimenting with until you get what you want (depending on your preference as to too much or too little).

Hi thanks for the input

Was hoping for a script to do this

Anyone have an example of a script?

Create a custom variable in BGInfo and attach to it the following VBScript:

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate,(Security)}!\\" & _
        strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent " _
        & "Where LogFile='System' and SourceName='user32'")
For Each objLogFile In colLogFiles
    Echo objLogFile.Message
    Exit For
Next

Select allOpen in new window

An see if will return the expected result.

I ran this

C:\Temp>cscript test.vbs
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation. All rights reserved.

C:\Temp\test.vbs(9, 5) Microsoft VBScript runtime error: Type mismatch: 'Echo'

also should we refine this to the event messages 1076 and 1074  if so how?

To see the results when running with cscript you shoud modify the line:

Echo objLogFile.Message

to display:

Wscript.Echo objLogFile.Message


But shoud remain simply echo when running in BGInfo.

To include both event codes use the following script:

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate,(Security)}!\\" & _
        strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent " _
        & "Where LogFile='System' and SourceName='user32' and (EventCode='1074' or EventCode='1076')")
For Each objLogFile In colLogFiles
    wscript.Echo objLogFile.Message
    Exit For
Next

Select allOpen in new window

Luconsta

Thanks that works great.

Is there anyway to only display

Reason Code
Shutdown Type
Comment

Really do not need the description field

see below

Here is the event 1074

Log Name:      System
Source:        USER32
Date:          7/12/2013 1:41:42 PM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:         PC01\Test
Computer:      TB-07182012
Description:
The process C:\Windows\system32\winlogon.exe (PC01) has initiated the restart of computer PC01 on behalf of user PC01\Test for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: restart
 Comment:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="USER32" />
    <EventID Qualifiers="32768">1074</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-07-12T17:41:42.000000000Z" />
    <EventRecordID>80923</EventRecordID>
    <Channel>System</Channel>
    <Computer>PC01\Test</Computer>
    <Security UserID="S-1-5-21-2327774470-480063297-2363401449-1000" />
  </System>
  <EventData>
    <Data>C:\Windows\system32\winlogon.exe (PC01\Test)</Data>
    <Data>PC01\Test</Data>
    <Data>No title for this reason could be found</Data>
    <Data>0x500ff</Data>
    <Data>restart</Data>
    <Data>
    </Data>
    <Data>PC01\Test</Data>
    <Binary>FF000500000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>

Script works great thanks

luconsta

can you look at this one for me?

It is part of this one but I created another question for it

https://www.experts-exchange.com/questions/28189036/VBS-Script-help-needed.html

Thanks