Conditionally run a script after a cold boot, but not after a warm reboot

I need to be able to run a script at startup, but only if the computer is restarting from a cold boot after a complete shutdown, not after a warm reboot.

How can I find out whether the computer has cold booted or warm rebooted?

I had hoped that Get-EventLog might do it, but

Get-EventLog -LogName system -Source user32 -Newest 1 | Select TimeGenerated, Message | ft -Wrap

gives me the same Reason Code and the same Shut-down type after both a cold and a warm start.

Any help greatly appreciated! Thanks in advance…

Why? AFAIK is - from a Windows perspective - no difference between those two start methods. The only difference is that a cold start performs a POST while a warm start skips that procedure.

Found this. May it helps…

 Get-WinEvent -FilterHashtable @{logname='System'; id=1074}  | ForEach-Object {
$rv = New-Object PSObject | Select-Object Date, User, Action, Process, Reason, ReasonCode, Comment
$rv.Date = $_.TimeCreated
$rv.User = $_.Properties[6].Value
$rv.Process = $_.Properties[0].Value
$rv.Action = $_.Properties[4].Value
$rv.Reason = $_.Properties[2].Value
$rv.ReasonCode = $_.Properties[3].Value
$rv.Comment = $_.Properties[5].Value
} | Select-Object Date, Action, Reason, User 

Olaf - the reason is that I have added a Gigabyte GC-Titan Ridge Thunderbolt card into my Lenovo Thinkstation P620, to attach a high-speed external drive via Thunderbolt 3.0 (since Lenovo haven’t yet launched their own Thunderbolt solution). I have managed to get it working in a slightly unorthodox fashion but while the setup survives a warm reboot, it doesn’t survive a cold boot and Windows can no longer see the thunderbolt drive. I have a script which reinstalls the working setup, and I want to be able to run this conditionally after a cold boot, but not a warm boot.

I think you may be right that Windows doesn’t seem to record a difference between the two different boot types - both are logged as “Restart”; but the system setup has changed in some respect.

I might have to test to see if the script can see the external drive and run the reinstallation script if it can’t…

First, you need to find the related error in Windows event viewer. there are multiple events which can help, such as:

41 (Kernel-Power)

6008 (EventLog)

But keep in mind to track the last reboot timdate and keep the search after this point, otherwise, the script will always consider that the system was cold start unless you clear the eventlog after each time.


What does the startup script configure or do? If it ‘doesn’t survive a cold boot and Windows can no longer see the thunderbolt drive’, what is different? Is a process not running? Another question, if you run the script on a warm boot does it break connection? If it’s just overwriting a configuration, what is the harm in always running it?

Thanks everyone for your various suggestions.

@Rob Simmers - the script opens a web browser to the Microsoft Store page for downloading Thunderbolt Control Center, allowing the user to download, install, and then run Thunderbolt Control Center to detect the drive when it is unplugged and plugged back in; and hit a key when done. Then the script uninstalls Thunderbolt Control Center, and reboots the machine. This is all necessary to get the Thunderbolt services working sufficiently for Windows to see the drive. Quite what Thunderbolt Control Center is doing, I am not sure, because although Thunderbolt Control Center can see the drive, it can’t do anything with it (it presents an option for the user to authorise the drive but that has no effect, since the machine doesn’t yet have a BIOS option to configure Thunderbolt, so can’t send authorisation over the header cable). Yet Thunderbolt Control Center does something that enables Windows to see the drive - not immediately, but after a restart, and only when Thunderbolt Control Center has been uninstalled again!
For details of the relevant saga, see

So I don’t want to run it after a warm boot when it is not necessary, because it requires user input and because it reboots the machine.

@Faris and @ChrisM_Cologne69 - thanks - the Reason for a 1074 seems to be the same on cold boot and warm reboot; investigating a combination of other events would seem to be necessary to distinguish between cold and warm boots.

In the end it seems quicker to achieve what I need by testing for the presence of the drive, which is after all what I need to establish, using:

$Disk = Get-WmiObject -Class Win32_logicaldisk -Filter “VolumeName = ‘Samsung_X5’”
if ( $Disk.VolumeName -neq ‘Samsung_X5’ )


[The whole script goes in here…]