Show Windows boot and shutdown events
Build a paste-ready command, then review its compatibility and effects before running it.
Get-WinEvent -FilterHashtable @{LogName='System'; Id=12,13,6005,6006} -MaxEvents 20 | Select-Object TimeCreated,Id,ProviderName,Messageread-onlyno known side effects Compatibility
WindowsVerified for Windows using powershell syntax.
Operational knowledgereview due 2027-01-20
RequirementsGet-WinEventGet-WinEvent must be installed and available on PATH.
Version supportGet-WinEvent Current supported releasesVerified for windows using powershell syntax; consult compatibility notes for platform-specific differences.
Expected signalsTimeCreated Id ProviderName MessageRepresentative successful output; values vary with the selected target and system state.
Known errorsGet-WinEvent: command not foundGet-WinEvent is missing or is not available on PATH.
VerifyGet-WinEvent -FilterHashtable @{LogName='System'; Id=12,13,6005,6006} -MaxEvents 20 | Select-Object TimeCreated,Id,ProviderName,MessageThe output matches the expected target and exits without an error.Rollback noteNot required: this command is read-only and does not change system state.
Command breakdown
01Get-WinEventCommandRuns the Get-WinEvent stage of this one-liner.
02-FilterHashtableOptionConfigures Get-WinEvent with the -FilterHashtable option.
03@{LogName='System'ArgumentPasses @{LogName='System' to Get-WinEvent.
04;Command separatorEnds this shell statement before the next one begins.
05Id=12,13,6005,6006}Variable assignmentSets a value used by the commands that follow.
06-MaxEventsCommandRuns the -MaxEvents stage of this one-liner.
0720ArgumentPasses 20 to -MaxEvents.
08|PipelinePasses the output on the left to the command on the right.
09Select-ObjectCommandRuns the Select-Object stage of this one-liner.
10TimeCreated,Id,ProviderName,MessageArgumentPasses TimeCreated,Id,ProviderName,Message to Select-Object.
Example input
Get-WinEvent -FilterHashtable @{LogName='System'; Id=12,13,6005,6006} -MaxEvents 20 | Select-Object TimeCreated,Id,ProviderName,Message
Example output
TimeCreated Id ProviderName Message
----------- -- ------------ -------
7/24/2026 8:02:31 AM 12 Microsoft-Windows-Kernel-General The operating system started at system time...
7/23/2026 6:42:10 PM 13 Microsoft-Windows-Kernel-General The operating system is shutting down...
Illustrative output — exact values vary by system and data.
Official sources