How to Get Last Reboot Time Using PowerShell?

by

Are you looking for the last reboot time on your Windows? You can easily find using PowerShell. In this detailed tutorial, you will learn how to get the last reboot time of your Windows computer using PowerShell.

There are multiple ways to retrieve the last reboot time in PowerShell. Here are a few useful ones.

  1. Using Get-CimInstance with Win32_OperatingSystem class
  2. Using Get-WmiObject with Win32_OperatingSystem class
  3. Using system event logs
  4. Using net stats command output via PowerShell

Method 1: Using Get-CimInstance

The Get-CimInstance cmdlet is the modern and preferred way to query Windows Management Instrumentation (WMI) data. It is faster and uses newer APIs compared to Get-WmiObject.

You can use the Get-CimInstance PowerShell cmdlet to get the last reboot time.

Open PowerShell and run:

Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object LastBootUpTime
  • Get-CimInstance queries the Win32_OperatingSystem WMI class.
  • The property LastBootUpTime contains the last reboot time in a WMI datetime format.

You can see the output below:

LastBootUpTime
--------------
24-11-2025 10:48:07

Here is the exact output in the screenshot below:

Get Last Reboot Time Using PowerShell

The raw output is in WMI datetime format. To convert it to a standard readable format, use the below script:

(Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime | 
    ForEach-Object { [Management.ManagementDateTimeConverter]::ToDateTime($_) }

Output:

Check out: Find SQL Server Instances using PowerShell

Method 2: Using Get-WmiObject

Get-WmiObject is the older cmdlet for WMI queries, still widely used for compatibility. Still you can use this cmdlet to get the last reboot time.

(Get-WmiObject -Class Win32_OperatingSystem).LastBootUpTime | 
    ForEach-Object { [Management.ManagementDateTimeConverter]::ToDateTime($_) }

This produces the same output as Method 1 but is slightly slower and deprecated in newer PowerShell versions.

Here is the exact output in the screenshot below:

PowerShell Get Last Reboot Time

Method 3: Using System Event Logs

Windows logs system startup events in the event log. You can query the event log to find the last boot time.

Query the System Event Log:

Get-EventLog -LogName System -InstanceId 6005 -Newest 1 | Select-Object TimeGenerated
  • Event ID 6005 corresponds to the “Event log service started,” which typically happens at boot.
  • TimeGenerated shows the timestamp of the event.

Output:

TimeGenerated
-------------
11/20/2025 12:00:05 PM

Note:

  • This method may not be as precise if the system has been running for a very long time or if event logs are cleared.
  • For more detailed uptime, use the WMI methods above.

Read Enable BitLocker with PowerShell

Method 4: Using net stats workstation

You can also use the legacy command net stats workstation which displays statistics including the system uptime.

Run the command in PowerShell:

net stats workstation | Select-String "Statistics since"

Output Example:

Statistics since 11/20/2025 12:00:00 PM

This date/time indicates when the system was last started.

Read Find OU of a Computer Using PowerShell

Find Last Reboot Time on Remote Computers

PowerShell allows querying remote machines, which is useful for system administrators managing multiple systems.

Using Get-CimInstance remotely:

$computerName = "RemotePC01"
Get-CimInstance -ComputerName $computerName -ClassName Win32_OperatingSystem | 
    Select-Object @{Name='LastBootUpTime';Expression={[Management.ManagementDateTimeConverter]::ToDateTime($_.LastBootUpTime)}}

Note:

  • You need appropriate permissions and firewall rules allowing WMI/CIM traffic.
  • PowerShell Remoting (WinRM) must be enabled on the target machine.

Automate Last Reboot Reports for Multiple Computers

You can create a script to check multiple computers and export the results to CSV for reporting.

$computers = @("PC1", "PC2", "PC3")

$results = foreach ($comp in $computers) {
    try {
        $os = Get-CimInstance -ComputerName $comp -ClassName Win32_OperatingSystem -ErrorAction Stop
        $bootTime = [Management.ManagementDateTimeConverter]::ToDateTime($os.LastBootUpTime)
        [PSCustomObject]@{
            ComputerName = $comp
            LastBootUpTime = $bootTime
        }
    }
    catch {
        [PSCustomObject]@{
            ComputerName = $comp
            LastBootUpTime = "Error: $_"
        }
    }
}

$results | Export-Csv -Path "C:\Reports\LastBootTimes.csv" -NoTypeInformation

Conclusion

In this tutorial, I explained how to get the last reboot time using PowerShell using various methods.

  • Get-CimInstance is the best and recommended method to retrieve the last reboot time on Windows systems using PowerShell. It is fast, reliable, and uses modern APIs.
  • Get-WmiObject provides similar functionality but is deprecated and slower; use it only if compatibility with older PowerShell versions is required.
  • Querying system event logs (Event ID 6005) offers an alternative way to find the last boot time, useful for forensic or detailed event-based analysis.
  • The net stats workstation command is a quick legacy method but less flexible and harder to parse programmatically.
  • You can convert WMI datetime format to a standard readable date/time using [Management.ManagementDateTimeConverter]::ToDateTime().

You may also like the following tutorials:

100 PowerShell cmdlets download free

100 POWERSHELL CMDLETS E-BOOK

FREE Download an eBook that contains 100 PowerShell cmdlets with complete script and examples.