collecting Statistics since on remote PC

[mrshortcut]

I just changed a scheduled reboot task on mulitple remote workstations so they reboot at the same time. I'm trying to find a way to verify they are all rebooting at the new time. If I remote into the workstation and run the Net statistics line I get my answer, but if I try and script it I keep getting my local reboot time instead of the time the remote PC restarted. Can someone help show me the errors of my ways?

Code: Select all

@echo 
Setlocal
set PC=10.13.202.21
net statistics workstation | find /i "statistics since"
set PC=10.13.202.22
net statistics workstation | find /i "statistics since"

The next step would be to figure out how I can log the results to a txt file. I know that I would have to include something along the lines of

Code: Select all

echo File "%PC%" (code for results of statistics since) > statisticslog.txt

but I am over my head

[jhicks]

The long term best solution is to begin using PowerShell with WMIGet-wmiobject win32_operatingsystem -computername Omega2 | select CSName,LastBootUptime

[mrshortcut]

Thank you for the responses. I havent tried WMI or powershell before so it looks like this will take some further research on how to get it to work.



For the WMI i changed to the following but keep getting a 0x80070005 error access is denied. Since I don't handle any of the firewalls I'll have to figure out with our IT managers how I'm being blocked and what it will take to get through.

Wmic /Node:10.13.202.21 Os Get CsName, LastBootUpTime

For the Powershell option since the workstations use XP I believe I would have to install the powershell service on each of the workstations which I don't think they'll approve as it would put more work on other departments.

Since I'm limited to the amount of changes I can make to security and services I wanted to get some input on an very long, but possible work around?

1. Create a batch that runs the

Code: Select all

net statistics workstation | find /i "statistics since"

locally on the workstation and then exports the resulting line to a txt file with the naming convention of "the workstation name-results" to a specific folder.

2. Then use PSexec to send and execute that batch and run a 2nd batch to collect the name of the file in that directory and write it to a log locally on my PC.

3. I can then view the log of all workstations to audit for any file name that doesn't have the correct restart time.

[mrshortcut]

Please forgive my ignorance but I never tried powershell before. I downloaded it off microsoft and attempted the suggestions. I tried researching some guides and websites to try and answer my own questions before posting but I don't know where to start.

You have to be an administrator to run WMIC. "Access Denied' is usually permissions. If you are not an administrator then you will NOT be able to use PsExec either.

Using POwerShell on the local PC will allow you to use WMI without being an adminnistrator. I am pretty sure that you can get the boot time without being an admin.

Here is the remote PowerShell code;

Code: Select all

gwmi win32_operatingsystem -computer computer1 | select csname, lastbootuptime

I ran this locally on my workstation and it displayed the results. So I confirmed the powershell was working when ran locally for me, but I cannot get powershell installed on each of the workstations.

You can run it like this.

Code: Select all

$computers = 'comp1','comp2',comp3'

gwmi win32_operatingsystem -computer $computers | select csname, lastbootuptime

This will give you back a list with all of the computer names and times.


I tried running this, substituting '10.13.202.21' for 'comp1' and received the following. I am a local admin on my workstation and the powershell title does state administrator(not sure if that makes any difference):

Get-WmiObject : Access is denied. (exception from HRESULT: 0x80070005 (E_ACCESS DENIED))
At line:1 char:5
= gwmi<<<< win32_operatingsystem - computer $computers: select csname, lastbootuptime
+ Category information : NotSpecified (:) [Get-WmiObject], UnauthorizedAccessException
+FullyQualifiedErrorID: System.UnauthorizedAccessExcetion,Microsoft.powershell.commands.getwmiobjectcommand

Any suggestions?

[mrshortcut]

Awesome!! Thank you both for your assistance. The following code brought up the last bootup time and csname for each of the workstations for the IP I listed in $computers

Code: Select all

$computers = 'IP1','IP2',etc

gwmi win32_operatingsystem -computer $computers -credential username |select csname, lastbootuptime |export-Csv c:lastbootuptime.csv

Is there an easier way to set the $Computers to a list of IP addresses so that I don't have to type them manually with all the ' and , especially since I have 100+ to do? I figured out how to export the data just not import. I tried

Code: Select all

$computers = import-csv c:test.csv 

but I think I'm still missing something. Each row of column A in the CSV is the IP address

[mrshortcut]

Thank you. That works perfect. I appreciate all the assistance