In which way are you scripting this? I’ve confirmed powershell’s Restart-Computer, shutdown.exe, and scheduled task all result in the eventlog entries. That is a function of windows itself when gracefully shutting down and start. I would assume you have a configuration issue or maybe filtering these out if you can’t see them/they aren’t created. On all normally functioning Windows machines, the following code will measure the reboot time in seconds based on the 6005/6006 eventlog entries.
$params = @{
FilterHashtable = @{
Logname = 'System'
ID = 6005,6006
ProviderName = 'Eventlog'
}
Oldest = $true
}
switch (Get-WinEvent @params){
{$_.id -eq 6005} {
if(!$stopped){
$stopped = 'No related shutdown event found'
$total = 'N/A'
}
else{
[float]$total = "{0:n2}" -f ($_.timecreated - $stopped).totalseconds
}
[PSCustomObject]@{
ShutdownTimestamp = $stopped
StartupTimestamp = $_.timecreated
TotalSeconds = $total
}
Remove-Variable started,stopped,total -ErrorAction SilentlyContinue
}
{$_.id -eq 6006} {
$stopped = $_.timecreated
}
}