PS C:\WINDOWS\system32> Get-CimInstance Win32_Service |
>> Where-Object { $_.Name -in 'IplirControl','vipnetswagent' } |
>> Select Name,State,StartMode |
>> Format-Table -Auto
Name State StartMode
---- ----- ---------
IplirControl Running Auto
vipnetswagent Running Auto
PS C:\WINDOWS\system32> $boot = (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
PS C:\WINDOWS\system32>
PS C:\WINDOWS\system32> Get-WinEvent -FilterHashtable @{
>> LogName='Application'
>> Id=1000
>> StartTime=$boot
>> } -ErrorAction SilentlyContinue |
>> Select TimeCreated,@{N='Data';E={$_.Properties.Value -join ' | '}} |
>> Where-Object { $_.Data -match 'IplirControl|iplayer|TAO_PI' } |
>> Format-List
PS C:\WINDOWS\system32> $boot = (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
PS C:\WINDOWS\system32>
PS C:\WINDOWS\system32> Get-WinEvent -FilterHashtable @{
>> LogName='System'
>> StartTime=$boot
>> } |
>> Where-Object {
>> $_.Id -in 7000,7009,7031 -and
>> $_.Message -match 'ViPNet|vipnetswagent|Iplir'
>> } |
>> Select TimeCreated,Id,Message |
>> Format-List
PS C:\WINDOWS\system32>