{"id":3245,"date":"2013-07-13T00:01:00","date_gmt":"2013-07-13T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2013\/07\/13\/weekend-scripter-use-powershell-to-get-startup-event-log-entries\/"},"modified":"2013-07-13T00:01:00","modified_gmt":"2013-07-13T00:01:00","slug":"weekend-scripter-use-powershell-to-get-startup-event-log-entries","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/weekend-scripter-use-powershell-to-get-startup-event-log-entries\/","title":{"rendered":"Weekend Scripter: Use PowerShell to Get Startup Event Log Entries"},"content":{"rendered":"

Summary<\/strong>: Microsoft Scripting Guy, Ed Wilson, talks about using Windows PowerShell to query event logs for entries created during startup.<\/span><\/p>\n

Microsoft Scripting Guy, Ed Wilson, is here. One of the things that annoys me is when something changes on my laptop, and I know that I did not do anything to directly cause the change. Obviously, I did something—but maybe not directly. For example, if I install a piece of software, and it also installs two or three startup services that go off and do this, that, or the other, without providing me the opportunity to choose, then I have changed something, but not directly.<\/p>\n

In fact, I would say that poorly designed, and badly behaved software, is the chief cause of me reinstalling Windows on my laptop. Whereas, I used to reinstall Windows every six months, I had have gotten away from that habit in recent years. However, all of these unintended started up services and applications, are killing the performance of my laptop. It is so bad now that I boot my laptop, and then I go do stuff. I come back, log on, and then go off and do more stuff. It is either that, or wait for about 15 minutes after logon before my laptop finally settles down enough to get some work done.<\/p>\n

Now I do not really have to wipe and reinstall (although that is always an option). I can use the tools built-in to Windows to troubleshoot and to diagnose the culprits. For me, the chief diagnostic tool is Windows PowerShell.<\/p>\n

Query multiple event logs<\/h2>\n

One of the best ways to troubleshoot anything in the Windows environment is to examine the appropriate event log. Unfortunately, with dozens of event logs, it is often a trick to know which log to examine. This is where Windows PowerShell shines. There are two cmdlets to work with event logs:<\/p>\n