Restart Event IDs

I can never remember what these Event IDs are, so it's time to record them here.

Event ID	Description
1074	Logged when an app (ex: Windows Update) causes the system to restart, or when a user initiates a restart or shutdown.
6006	Logged when an app (ex: Windows Update) causes the system to restart, or when a user initiates a restart or shutdown.
6008	Logged as a dirty shutdown. It gives the message "The previous system shutdown at time on date was unexpected".

Here's an article elaborating on this:

https://www.tenforums.com/tutorials/78335-read-shutdown-logs-event-viewer-windows.html

To PowerShell it (https://devblogs.microsoft.com/scripting/powertip-get-the-last-boot-time-with-powershell/):

PS2.0:

Get-WmiObject win32_operatingsystem | select csname, @{LABEL=’LastBootUpTime’;EXPRESSION={$_.ConverttoDateTime($_.lastbootuptime)}}

PS3.0

Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime