Analyzing Windows Launch Time

Beginning with Windows Vista/Server 2008, you can get rich information about your machine from the new additional application and service logs that are accessible by Get-WinEvent. You should have a look at the function Get-WindowsLaunch. It will tell you not just when your machine was booted, but also how long it took, how long the log-on process took, and how long  for startup commands to process!

Note: This function requires Admin privileges to return results so be  sure you can run it in a fully elevated PowerShell!

function Get-WindowsLaunch {
$filter = @{
logname='Microsoft-Windows-Diagnostics-Performance/Operational'
id=100
}

Get-WinEvent -FilterHashtable $filter |
ForEach-Object {
$info = 1 | Select-Object Date, Startduration, Autostarts, Logonduration
$info.Date = $_.Properties[1].Value
$info.Startduration = $_.Properties[5].Value
$info.Autostarts = $_.Properties[18].Value
$info.Logonduration = $_.Properties[43].Value
$info
}
}

 

You can even analyze the data returned by this function. This will retrieve  the average, minimum, and maximum boot-up time for your machine:

PS > Get-WindowsLaunch | Measure-Object StartDuration -min -max -Average

Count    : 29
Average  : 127667,034482759
Sum      :
Maximum  : 199194
Minimum  : 68191
Property : Startduration

 

Twitter This Tip! ReTweet this Tip!


Posted Mar 16 2011, 08:00 AM by ps1

Comments

Anders wrote re: Analyzing Windows Launch Time
on 03-22-2011 8:53 AM

FYI:

With English GUI the LogName-Filter:

'Microsoft-Windows-Diagnostics-Performance/Operational'

works, but with danish GUI it doesn't.

The filter:

'Microsoft-Windows-Diagnostics-Networking/Operational'

works with both Danish and English GUI.

Some entries in the eventviewer-hieraki has different names on the surface (from seen within eventViewer - when seeing properties the path to the log is:

%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Many of the entries are in fact named Operational (seen in EventViewer), but a few is called "Kan anvendes" which in english means "Is usable". One of them is infact:

Microsoft-Windows-Diagnostics-Performance

which might influence the failure on Danish GUI.

Error-message:

"Get-WinEvent : No events were found that match the specified selection criteria."

Copyright 2012 PowerShell.com. All rights reserved.