How to know if Windows was Restarted or Shut-down + Power Up

[alan_b]

What happened before the BIOS booted Windows ?
Was Windows Shut-down and powered down until a manual power up
OR was Restart used with no loss of power.

Before VISTA I had a computer with a serial interface card that sometimes stopped working.
A total power down and power up would correctly initialize and it would work again.
A Restart failed to initialize because the card included a device with a Reset pin that was not connected.

To a lesser degree, my Desktop has an abnormal mode and a normal mode of operation.
I now have a batch script that automatically appends to a log file whether Windows has started normal or abnormal.

Looking at the log and trying to remember what happened yesterday (last week is a blank) I now suspect that :-
normal mode happens after the computer has been fully shut down and then powered up through the BIOS and back into Windows,
abnormal mode happens if instead the computer has been restarted, maintaining power whilst closing Windows and then booting through BIOS and back into Windows.

I would like a bit of code that will automatically determine whether Windows has been logged on after a Restart or after a total shut-down and subsequent power up.
My intention is to scrutinize a few weeks logs to determine whether restart/shutdown is consistently the determining factor in misbehavior.

Regards
Alan

[Liviu]

Don't know that it's possible, at least not without a dedicated kernel-mode component, which is way outside the scope of batch language

That said, in non-home editions of XP or later, there is a "shutdown event tracker" which can be enabled via registry (http://support.microsoft.com/kb/555541) or policies (http://support.microsoft.com/kb/293814) and saves an entry to the event log whenever windows closes - which includes a "Shutdown Type" of "shutdown" vs. "reboot" description line. Filtering the System event log by Event ID 1704 then narrows the list to the respective entries and allows for easier browsing/exporting.

Liviu

[alan_b]

Thanks for the advice.

I have now searched for Shutdown Event Tracker and it seems to be available on Windows 7,
but it requires me to respond to a prompt advising why I have chosen to end Windows.
I was hoping for automatic determination.

I have now decided to simplify my life.

I will now use three desktop shortcuts instead of clicking the "Windows Start" and then selecting Shutdown/Restart/Sleep.
Each shortcut calls the same BAT script with the relevant argument,
and the script then appends the argument (with date and time) to my log file,
and then performs some housekeeping actions to tidy up,
and then executes the relevant Shutdown/Restart/Sleep action.

Regards
Alan

[Liviu]

Shutdown Event Tracker will prompt for a comment, indeed, but you can enter anything in there, even a single nonsense character. The determination of the type itself (power off vs. reboot) is automatic.

The entry in the event log contains a couple of lines like these:

Code: Select all

  Shutdown Type: shutdown
  Comment: testing

The first one is automatic, the second one is what the user entered at the prompt.

That said, your other solution is probably easier, as long as you are the only user and always remember to use the shortcuts, instead.

Liviu

[alan_b]

Thanks

I have now a working LOG system.

I have 4 desktop shortcuts pointing to my original Logging Script.

A simple Status shortcut has no arguments.
The other three have one each of these arguments :-

Code: Select all

 After Sleep
 After Restart
 After Shutdown

I prefixed the original code to show any arguments previously written to "CLOSING.TXT",
and to update "CLOSING.TXT" ready for the next time the script is run.
I postfixed the original code to take the relevant action when launched with arguments.

I have been logging the status of my computer at various times and observed erratic changes to SATA drive NUMBERS
(no effect on partition LETTERS).
I now suspect the erratic changes are not random but determined solely by the use of SHUTDOWN or SLEEP.
My enhancements are now producing results consistent with my suspicion.

Original code (redacted) plus new bits are as below

Regards
Alan

Code: Select all

@echo off & SETLOCAL & SETLOCAL EnableDelayedExpansion & CD /D D:\HDSentinel\Stats\ & CLS

:: New special code PREFIX :-
:: Create Variable holding Title for Log with current date and time and the previous CLOSING stautus
SET /P STATE=<CLOSING.TXT & SET "STATE=%DATE% %TIME% !STATE!" & ECHO(%*>CLOSING.TXT
::  AND save the Pending CLOSE status in CLOSING.TXT ready for the next time.

:: Existing code
<%in% (
ECHO( & ECHO %STATE%
  REM MY SPECIAL LOGGING CODE (heavily redacted)
)>> Total_Data_Report.txt
TYPE Total_Data_Report.txt

:: New special code POSTFIX:-
ECHO (%2
PAUSE
IF "%2"=="Sleep" rundll32.exe powrprof.dll,SetSuspendState 0,1,0
IF "%2"=="Restart" Shutdown.exe -r -t 00
IF "%2"=="Shutdown" Shutdown.exe -s -t 00
:: End of special code

EXIT /B