Find out windows server unexpected reboot information

This blog post will break down the provided PowerShell code, Understanding when and why your server rebooted is crucial for troubleshooting performance issues, security incidents, and overall system health. PowerShell, a powerful scripting language, provides a convenient way to extract this information from the Windows Event Log. This blog post will dissect the following PowerShell command and explain how it can be used to uncover your server’s reboot history:

1234567Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Id = @(6005, 6006, 1074)
    StartTime = (Get-Date).AddDays(-60)  # Last 60 days
    EndTime = Get-Date
} -MaxEvents 50 | # Recent 50 messages
Select-Object TimeCreated, Id, Message

Here are the results looks like: 

Understanding the Results:

Executing this command will output a list of events related to system shutdowns and restarts within the last 60 days. Each entry will display the event time, event ID, and a brief description of the event.