# Script to restart Windows devices

Regularly restarting a Windows device ensures optimal performance by enabling the completion of essential updates and installations, finalizing security patches and driver integrations. It resolves memory leaks by completely clearing the system’s volatile Random Access Memory (RAM). A restart can also terminate frozen or stuck background processes and services, release file locks and restore core system functions.

Deploying custom scripts to remotely restart managed devices provides administrators with granular control beyond standard system commands. Using the [Execute Custom Script](https://www.hexnode.com/mobile-device-management/help/executing-custom-scripts-for-windows/) action in Hexnode UEM, you can fully customize the restart experience.

Specifically, these scripts allow for a delayed reboot or a custom warning message displayed to the user beforehand. Additionally, they can retrieve critical audit data, such as the last restart time and the identity of the user who initiated the action. This article provides both **Batch** and **PowerShell** scripts to facilitate these workflows.

 Supported Versions 
The script is supported for execution on the following Windows versions:

- Windows 10 v1803+
- Windows 10 v1703 to Windows 10 v1709 (if .NET Framework v4.7.1+ is installed on the device).
- Windows 11 (Pro, Enterprise, Education)

 

 Disclaimer: 
The sample scripts provided below are adapted from third-party open-source sites.

 

Executing custom script via Hexnode UEM – Quick steps
-----------------------------------------------------

1. Navigate to the **Manage** tab in your Hexnode UEM console and select your Windows device.
2. From **Actions**, select **Execute Custom Script** from **Deployments**. [![The Execute Custom Script action is found under the “deployments” subsection of the Remote actions for the Windows device.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/The-Execute-Custom-Script-remote-action-can-be-selected-under-deployments-for-the-device.png)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/The-Execute-Custom-Script-remote-action-can-be-selected-under-deployments-for-the-device.png "The Execute Custom Script remote action can be selected under deployments for the device")
3. Upload the `.ps1` PowerShell script and click **Execute**.
4. The script output is available via **Action History > Execute Custom Script action > Status > Show Output**.
    [![Navigating to the Show Output button in the Action History tab to verify the results of a scheduled Windows restart script.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Windows-restart-script-results-in-Hexnode-Show-Output-button.png)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Windows-restart-script-results-in-Hexnode-Show-Output-button.png "Windows restart script results in Hexnode Show Output button")

Batch scripts
-------------

1. ### Restart device after a time delay
    
    Batch script to restart Windows after a delay
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    @echo off setlocal :: Enter a number (e.g., 5) in the Arguments field in Hexnode console set "delay\_minutes=%1" :: Fallback to 1 minute if no argument is provided if "%delay\_minutes%"=="" set "delay\_minutes=1" :: Convert minutes to seconds for the shutdown command set /a "delay\_seconds=%delay\_minutes% \* 60" :: Dynamic message that reflects the chosen time set "message=Your administrator has scheduled a system restart in %delay\_minutes% minute(s). Please save your work immediately." echo -------------------------------------------------- echo INITIATING REMOTE SYSTEM RESTART echo -------------------------------------------------- echo Configuration: %delay\_minutes% minute(s) delay echo Status: Sending command and notification... :: Execute the shutdown :: /r = Restart | /f = Force | /t = Time in seconds | /c = Dynamic Message shutdown /r /f /t %delay\_seconds% /c "%message%" echo -------------------------------------------------- echo Command Status: Success echo The device will restart in %delay\_minutes% minutes. echo -------------------------------------------------- endlocal 
    
       1
    
    2
    
    3
    
    4
    
    5
    
    6
    
    7
    
    8
    
    9
    
    10
    
    11
    
    12
    
    13
    
    14
    
    15
    
    16
    
    17
    
    18
    
    19
    
    20
    
    21
    
    22
    
    23
    
    24
    
    25
    
    26
    
    27
    
    28
    
    29
    
    30
    
    31
    
    
    
      @echo off
    
    setlocal
    
    
    
    :: Enter a number (e.g., 5) in the Arguments field in Hexnode console
    
    set "delay\_minutes=%1"
    
    
    
    :: Fallback to 1 minute if no argument is provided
    
    if "%delay\_minutes%"=="" set "delay\_minutes=1"
    
    
    
    :: Convert minutes to seconds for the shutdown command
    
    set /a "delay\_seconds=%delay\_minutes% \* 60"
    
    
    
    :: Dynamic message that reflects the chosen time
    
    set "message=Your administrator has scheduled a system restart in %delay\_minutes% minute(s). Please save your work immediately."
    
    
    
    echo --------------------------------------------------
    
    echo INITIATING REMOTE SYSTEM RESTART 
    
    echo --------------------------------------------------
    
    echo Configuration: %delay\_minutes% minute(s) delay
    
    echo Status: Sending command and notification...
    
    
    
    :: Execute the shutdown
    
    :: /r = Restart | /f = Force | /t = Time in seconds | /c = Dynamic Message
    
    shutdown /r /f /t %delay\_seconds% /c "%message%"
    
    
    
    echo --------------------------------------------------
    
    echo Command Status: Success
    
    echo The device will restart in %delay\_minutes% minutes.
    
    echo --------------------------------------------------
    
    
    
    endlocal 
    
    
    
       
    
     
    
     
    
    When deploying the script via the Execute Custom Script action, enter the desired restart delay (in minutes) as a numerical value within the Arguments field; this automatically triggers a warning message on the device to notify the user of the imminent restart.
    
    [![The execution logs for a scheduled Windows restart are displayed within the Show Output window to verify the script's success.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Scheduled-Windows-Restart-results-in-the-Show-Output-Window.png)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Scheduled-Windows-Restart-results-in-the-Show-Output-Window.png "The execution logs for a scheduled Windows restart are displayed within the Show Output window to verify the script's success.")
2. ### Restart device immediately
    
    Execute the script below to restart the device immediately.
    
    Batch script to restart Windows device
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    @echo off setlocal :: Configuration for immediate action set "delay\_seconds=0" echo -------------------------------------------------- echo INITIATING IMMEDIATE RESTART echo -------------------------------------------------- echo Status: Executing shutdown command (no delay)... :: Execute the shutdown :: /r = Restart :: /f = Force close all applications :: /t 0 = Zero second delay (immediate) shutdown /r /f /t %delay\_seconds% echo -------------------------------------------------- echo Command Status: Success echo The device is restarting now. echo -------------------------------------------------- endlocal 
    
       1
    
    2
    
    3
    
    4
    
    5
    
    6
    
    7
    
    8
    
    9
    
    10
    
    11
    
    12
    
    13
    
    14
    
    15
    
    16
    
    17
    
    18
    
    19
    
    20
    
    21
    
    22
    
    23
    
    
    
      @echo off
    
    setlocal
    
    
    
    :: Configuration for immediate action
    
    set "delay\_seconds=0"
    
    
    
    echo --------------------------------------------------
    
    echo INITIATING IMMEDIATE RESTART 
    
    echo --------------------------------------------------
    
    echo Status: Executing shutdown command (no delay)...
    
    
    
    :: Execute the shutdown
    
    :: /r = Restart
    
    :: /f = Force close all applications
    
    :: /t 0 = Zero second delay (immediate)
    
    shutdown /r /f /t %delay\_seconds%
    
    
    
    echo --------------------------------------------------
    
    echo Command Status: Success
    
    echo The device is restarting now.
    
    echo --------------------------------------------------
    
    
    
    endlocal 
    
    
    
       
    
     
    
      
    
    [![The execution logs for an immediate Windows Restart action are displayed within the Show Output window on the Hexnode console to confirm the script's success. ](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Immediate-Windows-Restart-results-in-Hexnode.png)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Immediate-Windows-Restart-results-in-Hexnode.png "Immediate Windows Restart results in Hexnode")
3. ### Check last restart time of device
    
    Batch script to check last restart time of device
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    @echo off echo -------------------------------------------------- echo SYSTEM RESTART INFORMATION echo -------------------------------------------------- :: Retrieve the Restart Time for /f "tokens=1,\* delims=:" %%a in ('systeminfo ^| find "System Boot Time"') do ( echo Last Restart:%%b ) :: Retrieve System Uptime (Optional) for /f "tokens=1,\* delims=:" %%a in ('net statistics workstation ^| find "Statistics since"') do ( echo Monitoring Since:%%b ) echo -------------------------------------------------- echo Status: Complete 
    
       1
    
    2
    
    3
    
    4
    
    5
    
    6
    
    7
    
    8
    
    9
    
    10
    
    11
    
    12
    
    13
    
    14
    
    15
    
    16
    
    17
    
    
    
      @echo off
    
    echo --------------------------------------------------
    
    echo SYSTEM RESTART INFORMATION 
    
    echo --------------------------------------------------
    
    
    
    :: Retrieve the Restart Time
    
    for /f "tokens=1,\* delims=:" %%a in ('systeminfo ^| find "System Boot Time"') do (
    
     echo Last Restart:%%b
    
    )
    
    
    
    :: Retrieve System Uptime (Optional)
    
    for /f "tokens=1,\* delims=:" %%a in ('net statistics workstation ^| find "Statistics since"') do (
    
     echo Monitoring Since:%%b
    
    )
    
    
    
    echo --------------------------------------------------
    
    echo Status: Complete 
    
    
    
       
    
     
    
     
    
    Script returns the date and time of the last restart of the endpoint device to the **Show Output** window in the UEM console.
    [![The last restart timestamp for Windows device shown within the Show Output screen.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Results-of-last-restart-time.png)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Results-of-last-restart-time.png "Results of last restart time.")

PowerShell scripts
------------------

1. ### Restart device
    
    Execute the following command to restart the device immediately.
    
    PowerShell script to restart Windows device
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    Write-Host "--------------------------------------------------" Write-Host " INITIATING IMMEDIATE RESTART " Write-Host "--------------------------------------------------" Write-Host "Status: Sending restart command to the OS..." # -Force: Closes applications without warning the user # -Confirm:$false: Prevents the script from waiting for a manual 'Yes' Restart-Computer -Force -Confirm:$false Write-Host "--------------------------------------------------" Write-Host "Command Status: Success" Write-Host "The device is restarting now." Write-Host "--------------------------------------------------"
    
       1
    
    2
    
    3
    
    4
    
    5
    
    6
    
    7
    
    8
    
    9
    
    10
    
    11
    
    12
    
    13
    
    14
    
    
    
      Write-Host "--------------------------------------------------"
    
    Write-Host " INITIATING IMMEDIATE RESTART "
    
    Write-Host "--------------------------------------------------"
    
    
    
    Write-Host "Status: Sending restart command to the OS..."
    
    
    
    \# -Force: Closes applications without warning the user
    
    \# -Confirm:$false: Prevents the script from waiting for a manual 'Yes'
    
    Restart-Computer -Force -Confirm:$false
    
    
    
    Write-Host "--------------------------------------------------"
    
    Write-Host "Command Status: Success"
    
    Write-Host "The device is restarting now."
    
    Write-Host "--------------------------------------------------"
    
    
    
       
    
     
    
      
    
    [![The execution logs for scheduled Windows restart via PowerShell are displayed in the Hexnode Show Output window to verify task registration and script success.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Windows-restart-using-PowerShell-script-results-in-Hexnode.png)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Windows-restart-using-PowerShell-script-results-in-Hexnode.png "Windows restart using PowerShell script results in Hexnode")
2. ### Schedule device restart 
    
    To schedule restart on a Windows device, run the following script:
    
    PowerShell script to schedule Windows restart
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    Write-Host "--------------------------------------------------" Write-Host " SCHEDULING RESTART TASK " Write-Host "--------------------------------------------------" # 1. Define Paths and Content $ScriptPath = "C:\\Users\\Admin\\Downloads\\restart.ps1" $ScriptContent = "Restart-Computer -Force" try { # 2. Create the physical script file Write-Host "Status: Creating local script at $ScriptPath..." Set-Content -Path $ScriptPath -Value $ScriptContent -Force # 3. Configure the Task Trigger (Daily at 09:35) $Trigger = New-ScheduledTaskTrigger -Daily -At 09:35 # 4. Configure the Task Action (Execute PowerShell) $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-ExecutionPolicy Bypass -NoProfile -File `"$ScriptPath`"" # 5. Set Principal for Highest Privileges $Principal = New-ScheduledTaskPrincipal -RunLevel Highest -GroupId "BUILTIN\\Users" # 6. Register the Task Write-Host "Status: Registering Task 'MaintenanceRestart' in Task Scheduler..." Register-ScheduledTask -TaskName "MaintenanceRestart" -Trigger $Trigger -Principal $Principal -Action $Action -Force Write-Host "--------------------------------------------------" Write-Host "SUCCESS: Task 'MaintenanceRestart' scheduled successfully." Write-Host "The device will restart daily at 09:35 AM." } catch { Write-Host "ERROR: Failed to register task. Details: $($\_.Exception.Message)" } Write-Host "--------------------------------------------------" Write-Host "Status: Complete"
    
       1
    
    2
    
    3
    
    4
    
    5
    
    6
    
    7
    
    8
    
    9
    
    10
    
    11
    
    12
    
    13
    
    14
    
    15
    
    16
    
    17
    
    18
    
    19
    
    20
    
    21
    
    22
    
    23
    
    24
    
    25
    
    26
    
    27
    
    28
    
    29
    
    30
    
    31
    
    32
    
    33
    
    34
    
    35
    
    36
    
    
    
      Write-Host "--------------------------------------------------"
    
    Write-Host " SCHEDULING RESTART TASK "
    
    Write-Host "--------------------------------------------------"
    
    
    
    \# 1. Define Paths and Content
    
    $ScriptPath = "C:\\Users\\Admin\\Downloads\\restart.ps1"
    
    $ScriptContent = "Restart-Computer -Force"
    
    
    
    try {
    
     \# 2. Create the physical script file
    
     Write-Host "Status: Creating local script at $ScriptPath..."
    
     Set-Content -Path $ScriptPath -Value $ScriptContent -Force
    
    
    
     \# 3. Configure the Task Trigger (Daily at 09:35)
    
     $Trigger = New-ScheduledTaskTrigger -Daily -At 09:35
    
    
    
     \# 4. Configure the Task Action (Execute PowerShell)
    
     $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-ExecutionPolicy Bypass -NoProfile -File `"$ScriptPath`""
    
    
    
     \# 5. Set Principal for Highest Privileges
    
     $Principal = New-ScheduledTaskPrincipal -RunLevel Highest -GroupId "BUILTIN\\Users"
    
    
    
     \# 6. Register the Task
    
     Write-Host "Status: Registering Task 'MaintenanceRestart' in Task Scheduler..."
    
     Register-ScheduledTask -TaskName "MaintenanceRestart" -Trigger $Trigger -Principal $Principal -Action $Action -Force
    
    
    
     Write-Host "--------------------------------------------------"
    
     Write-Host "SUCCESS: Task 'MaintenanceRestart' scheduled successfully."
    
     Write-Host "The device will restart daily at 09:35 AM."
    
    }
    
    catch {
    
     Write-Host "ERROR: Failed to register task. Details: $($\_.Exception.Message)"
    
    }
    
    
    
    Write-Host "--------------------------------------------------"
    
    Write-Host "Status: Complete"
    
    
    
       
    
     
    
      
    
    The script triggers, `$Trigger`, an action `$Action` at a specific time and frequency set by the administrator deploying the script. The Action is the execution of the script file `restart.ps1`.The command to restart the device is given under `$ScriptContent`, which is saved to the `restart.ps1` script file. The restart.ps1 script file is saved to the location specified by the admin under `$ScriptPath`.
    
    The scheduler script will use the path of `restart.ps1` provided to trigger the restart action with the highest privilege.
    
    The administrator must also configure the frequency to run the script (Once, Daily, Weekly etc) in `$Trigger` replacing `-Daily` in the script and the specific time (in 24 hour format) to execute the scheduler script, following `–At`.
3. ### Find the user who last restarted the device
    
    PowerShell script to fetch user who last restarted Windows device
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    Write-Host "--------------------------------------------------" Write-Host " USER RESTART IDENTIFICATION " Write-Host "--------------------------------------------------" # Attempt to retrieve the last reboot event $rebootData = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074; ProviderName='User32'} -MaxEvents 1 -ErrorAction SilentlyContinue if ($rebootData) { # Execute the exact snippet provided $rebootData | ForEach-Object { $output = "Restart initiated by: $($\_.Properties\[6\].Value)" Write-Host $output } } else { Write-Host "Result: No recent restart logs (ID 1074) found." } Write-Host "--------------------------------------------------" Write-Host "Status: Execution Complete" Write-Host "--------------------------------------------------" 
    
       1
    
    2
    
    3
    
    4
    
    5
    
    6
    
    7
    
    8
    
    9
    
    10
    
    11
    
    12
    
    13
    
    14
    
    15
    
    16
    
    17
    
    18
    
    19
    
    20
    
    21
    
    
    
      Write-Host "--------------------------------------------------"
    
    Write-Host " USER RESTART IDENTIFICATION "
    
    Write-Host "--------------------------------------------------"
    
    
    
    \# Attempt to retrieve the last reboot event
    
    $rebootData = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074; ProviderName='User32'} -MaxEvents 1 -ErrorAction SilentlyContinue
    
    
    
    if ($rebootData) {
    
     \# Execute the exact snippet provided
    
     $rebootData | ForEach-Object {
    
     $output = "Restart initiated by: $($\_.Properties\[6\].Value)"
    
     Write-Host $output
    
     }
    
    }
    
    else {
    
     Write-Host "Result: No recent restart logs (ID 1074) found."
    
    }
    
    
    
    Write-Host "--------------------------------------------------"
    
    Write-Host "Status: Execution Complete"
    
    Write-Host "--------------------------------------------------" 
    
    
    
       
    
     
    
     
    
    On running the script, the name of the user who last restarted the remote device is returned to the Hexnode UEM console in the **Show Output** window.
    [![The details of the user who last restarted the device as obtained from the Show Output window using a Windows PowerShell script.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/User-who-last-restarted-the-system-obtained-using-Windows-restart-PowerShell-script.png)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/User-who-last-restarted-the-system-obtained-using-Windows-restart-PowerShell-script.png%20%20 "User who last restarted the system obtained using Windows restart PowerShell script")
4. ### Check last restart and uptime of device
    
    PowerShell script to fetch last restart and uptime
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    Write-Host "--------------------------------------------------" Write-Host " SYSTEM RESTART & UPTIME REPORT " Write-Host "--------------------------------------------------" # 1. Retrieve the Last Restart Time and Computer Name $OS = Get-CimInstance Win32\_OperatingSystem $BootTime = $OS.LastBootUpTime $ComputerName = $OS.CSName # 2. Calculate Uptime Span $UptimeSpan = (Get-Date) - $BootTime # 3. Format Uptime for human readability $UptimeString = "{0} Days, {1} Hours, {2} Minutes" -f $UptimeSpan.Days, $UptimeSpan.Hours, $UptimeSpan.Minutes # 4. Final Output to Hexnode Console Write-Host "Computer Name : $ComputerName" Write-Host "Last Restart Time : $BootTime" Write-Host "Current Uptime : $UptimeString" Write-Host "--------------------------------------------------" Write-Host "Status: Complete"
    
       1
    
    2
    
    3
    
    4
    
    5
    
    6
    
    7
    
    8
    
    9
    
    10
    
    11
    
    12
    
    13
    
    14
    
    15
    
    16
    
    17
    
    18
    
    19
    
    20
    
    21
    
    22
    
    
    
      Write-Host "--------------------------------------------------"
    
    Write-Host " SYSTEM RESTART & UPTIME REPORT "
    
    Write-Host "--------------------------------------------------"
    
    
    
    \# 1. Retrieve the Last Restart Time and Computer Name
    
    $OS = Get-CimInstance Win32\_OperatingSystem
    
    $BootTime = $OS.LastBootUpTime
    
    $ComputerName = $OS.CSName
    
    
    
    \# 2. Calculate Uptime Span
    
    $UptimeSpan = (Get-Date) - $BootTime
    
    
    
    \# 3. Format Uptime for human readability
    
    $UptimeString = "{0} Days, {1} Hours, {2} Minutes" -f $UptimeSpan.Days, $UptimeSpan.Hours, $UptimeSpan.Minutes
    
    
    
    \# 4. Final Output to Hexnode Console
    
    Write-Host "Computer Name : $ComputerName"
    
    Write-Host "Last Restart Time : $BootTime"
    
    Write-Host "Current Uptime : $UptimeString"
    
    
    
    Write-Host "--------------------------------------------------"
    
    Write-Host "Status: Complete"
    
    
    
       
    
     
    
     
    
    Script returns the date and time of the last restart and the uptime of the endpoint device to the UEM console in the **Show Output** window.
    [![The Hexnode console displays a PowerShell script output showing the Windows device's last restart time and uptime.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Last-restart-and-uptime-report-of-Windows-device-obtained-via-Hexnode.png)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Last-restart-and-uptime-report-of-Windows-device-obtained-via-Hexnode.png "Last restart and uptime report of Windows device obtained via Hexnode")
5. ### Get Windows restart audit report
    
    PowerShell script to obtain Windows restart audit report
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    Write-Host "--------------------------------------------------" Write-Host " SYSTEM RESTART AUDIT REPORT " Write-Host "--------------------------------------------------" # 1. RESTART HISTORY (Event 6005 - System Start Times) Write-Host "RESTART HISTORY" Write-Host "---------------" $HistoryEvents = Get-CimInstance Win32\_NTLogEvent -Filter "LogFile='System' and EventCode=6005" | Select-Object -First 5 if ($HistoryEvents) { foreach ($Event in $HistoryEvents) { Write-Host "System Start Time: $($Event.TimeWritten)" } } else { Write-Host "No startup history events found." } Write-Host "--------------------------------------------------" # 2. RESTART LOG (Event 1074 - Initiation Details) Write-Host "RESTART LOG" Write-Host "-----------" $LogEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 5 -ErrorAction SilentlyContinue if ($LogEvents) { foreach ($Event in $LogEvents) { Write-Host "Event time: $($Event.TimeCreated)" Write-Host "Event ID: $($Event.Id)" Write-Host "Initiated User: $($Event.Properties\[6\].Value)" Write-Host "Reason for initiation: $($Event.Properties\[2\].Value)" Write-Host "" } } else { Write-Host "No detailed restart logs found (ID 1074)." } Write-Host "--------------------------------------------------" Write-Host "Status: Audit Complete"
    
       1
    
    2
    
    3
    
    4
    
    5
    
    6
    
    7
    
    8
    
    9
    
    10
    
    11
    
    12
    
    13
    
    14
    
    15
    
    16
    
    17
    
    18
    
    19
    
    20
    
    21
    
    22
    
    23
    
    24
    
    25
    
    26
    
    27
    
    28
    
    29
    
    30
    
    31
    
    32
    
    33
    
    34
    
    35
    
    36
    
    37
    
    38
    
    
    
      Write-Host "--------------------------------------------------"
    
    Write-Host " SYSTEM RESTART AUDIT REPORT "
    
    Write-Host "--------------------------------------------------"
    
    
    
    \# 1. RESTART HISTORY (Event 6005 - System Start Times)
    
    Write-Host "RESTART HISTORY"
    
    Write-Host "---------------"
    
    $HistoryEvents = Get-CimInstance Win32\_NTLogEvent -Filter "LogFile='System' and EventCode=6005" | Select-Object -First 5
    
    
    
    if ($HistoryEvents) {
    
     foreach ($Event in $HistoryEvents) {
    
     Write-Host "System Start Time: $($Event.TimeWritten)"
    
     }
    
    } else {
    
     Write-Host "No startup history events found."
    
    }
    
    
    
    Write-Host "--------------------------------------------------"
    
    
    
    \# 2. RESTART LOG (Event 1074 - Initiation Details)
    
    Write-Host "RESTART LOG"
    
    Write-Host "-----------"
    
    $LogEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 5 -ErrorAction SilentlyContinue
    
    
    
    if ($LogEvents) {
    
     foreach ($Event in $LogEvents) {
    
     Write-Host "Event time: $($Event.TimeCreated)"
    
     Write-Host "Event ID: $($Event.Id)"
    
     Write-Host "Initiated User: $($Event.Properties\[6\].Value)"
    
     Write-Host "Reason for initiation: $($Event.Properties\[2\].Value)"
    
     Write-Host ""
    
     }
    
    } else {
    
     Write-Host "No detailed restart logs found (ID 1074)."
    
    }
    
    
    
    Write-Host "--------------------------------------------------"
    
    Write-Host "Status: Audit Complete"
    
    
    
       
    
     
    
     
    
    The Windows restart log is retrieved using the PowerShell `<strong>Get-WinEvent</strong>` command, which provides a detailed audit trail of every restart since the device was enrolled in Hexnode. This log identifies the specific date and time of each event along with the name of the user or system process that initiated the restart.
    [![The Hexnode Show Output window displays a comprehensive restart log retrieved via a PowerShell script, listing the timestamps and initiating users for each restart event on the Windows device.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Windows-device-restart-log-as-obtained-from-Hexnode.png)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Windows-device-restart-log-as-obtained-from-Hexnode.png "Windows device restart log as obtained from Hexnode")
    
    Admins can access the comprehensive list directly through the **Show Output** window to review the full history of system restart events.
    [![The Hexnode console displays the Windows device restart history report, showing a chronological list of system restart times as retrieved by the PowerShell script.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Results-of-the-Windows-device-restart-history-in-Hexnode-console.png)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2021/09/Results-of-the-Windows-device-restart-history-in-Hexnode-console.png "Results of the Windows device restart history in Hexnode console")

 Notes:- It is recommended to manually validate the script execution on a system before executing the action in bulk.
- Hexnode will not be responsible for any damage/loss to the system on the behavior of the script.