Category filter
Script to restart Windows 10 devices
As organizations become more application-centric, corporate devices will need to handle more applications over time. Unfortunately, using more applications can lead to extended use of the Random Access Memory (RAM), which can degrade device performance. Restarting a Windows device clears the device’s RAM and improves its performance. Device restart also initiates the installation of pending OS updates and software patches on the device. Additionally, restarting the device can be used as a troubleshooting option. Admins can use Hexnode UEM to deploy a custom script that will restart the remote device after a set period.
The sample scripts provided below are adapted from third-party open-source sites.
Batch script
Restart device
|
1 |
shutdown.exe /r /t <time delay> |
Replace <time delay> with an integer indicating the delay time in seconds before the system restarts.
Execute the script below to restart the device immediately.
|
1 |
shutdown.exe /r /t 00 |
Display warning message before restart
|
1 2 |
msg * <message> shutdown.exe /r /t <time delay> |
Substitute <message> with the warning message to be displayed on the system as a popup before the device restarts.
Check the name of the user who last rebooted the device
|
1 |
wevtutil qe system "/q:*[System[(EventID=1074)]]" /rd:true /f:text /c:1 | findstr /i "User Name" |
The name of the user who last rebooted the endpoint device is returned to the UEM console upon running the script.
Check last boot time of device
|
1 |
wevtutil qe system "/q:*[System[(EventID=1074)]]" /rd:true /f:text /c:1 | findstr /i "date" |
Script returns the date and time of the last reboot of the endpoint device to the UEM console.
PowerShell script
Restart device
|
1 |
Restart-Computer -force |
Schedule device restart
To schedule restart on a Windows device, run the following script:
|
1 2 3 4 5 6 7 8 9 |
$ScriptPath = "C:Users\Desktop\restart.ps1" $Trigger= New-ScheduledTaskTrigger -Daily -At 07:44pm $Action= New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-executionpolicy bypass -noprofile -file $ScriptPath" $principal = New-ScheduledTaskPrincipal -RunLevel Highest -GroupId "BUILTIN\Users" Register-ScheduledTask -TaskName "MyTask" -Trigger $Trigger -Principal $principal -Action $Action |
The script triggers ($Trigger) an action ($Action) at a specific time and frequency set by the user. The Action is a script restart.ps1, which the user must save on the device and contains the command to restart the device.
The scheduler script will use the path of restart.ps1 provided by the user as $ScriptPath to trigger the restart action with the highest privilege.
The user must provide the script path to restart.ps1, frequency to run the script (Once, Daily, Weekly etc) and the specific time to execute the scheduler script.
Find the user who last rebooted the device
|
1 |
wevtutil qe system "/q:*[System[(EventID=1074)]]" /rd:true /f:text /c:1 | findstr /i "User Name" |
On running the script, the name of the user who last restarted the remote device is returned to the Hexnode UEM console.
Check last boot time of device
|
1 |
Get-WmiObject win32_operatingsystem | select csname, @{LABEL='LastBootUpTime';EXPRESSION={$_.ConverttoDateTime($_.lastbootuptime)}} |
Script returns the date and time of the last reboot of the endpoint device to the UEM console.
Get time span since last reboot
|
1 |
(get-date) - (gcim Win32_OperatingSystem).LastBootUpTimea |
The script returns the time span since the last reboot of the device in days, hours, minutes, and seconds in a listed format
Get Windows reboot history
|
1 |
Get-WmiObject Win32_NTLogEvent -filter "LogFile='System' and EventCode=6005" | Select ComputerName, EventCode, @{LABEL='TimeWritten';EXPRESSION={$_.ConverttoDateTime($_.TimeWritten)}} |
The script returns a list of instances when the endpoint device was rebooted with the date and time of reboot.
Get Windows reboot log
|
1 |
Get-EventLog System -Newest 10000 | Where EventId -in 1074 | Format-Table TimeGenerated,EventId,UserName,Message -AutoSize -wrap |
The reboot log in Windows can be retrieved from the command-line using the PowerShell’s Get-EventLog command. The log gives information regarding all the instances (since the device got connected to the UEM console) when the endpoint device was rebooted, including the date and time of reboot and the name of the user who initiated the reboot.
- It is recommended to manually validate the script execution on a system before executing the action in bulk.
- Hexnode will not be responsible for any damage/loss to the system on the behavior of the script.
