Tuesday, April 11, 2017

When was Windows started?

How long have the Server of PC been running? Sometimes you need to figure when the OS was started. As always there are different was of getting this information. Some ways are quick and easy when you are sitting with the OS GUI in front of you, but other times you might want to use it in a script or get it from the command line. Here are a selection of methods I use.


You can checkout network adapter duration, but you will easier find the "Task Manager - Performance - Up Time"

 Command Prompt

Systeminfo might be the easiest way, if you forget the parameters you can just run "Systeminfo" and you will get alot of information, included "System Boot Time" and "Original Install Date". You also get other important information like manufacturer, model, type and BIOs version. Simply Modifying parameters on my string and you get single output on the information you want
systeminfo | findstr "Time:"

Or you can use the Net command
net statistics workstation | findstr "since"
You might notice that this way report a later time the the Systeminfo, and that is because the "Workstation" service starts a bit later then what "Systeminfo" count the system as started


And of course you might want to know the PowerShell method
$osinfo = get-wmiobject win32_operatingsystem
Write-Host "Last Boot Time: " ($osinfo.ConvertToDateTime($osinfo.LastBootUpTime) -f "MM/dd/yyyy")


And if things are to easy why not try the wmic way
wmic os get lastbootuptime
The returned value looks strange, but if you take a closer look you will see the format Year-Month-Day-Time

Windows Defender Advanced Threath Protection - Isolation and Investigaton packages

I have been playing around with the Windows Defender ATP and recorded a quick video showing the investigation package collection and isol...