Member Avatar for jaejoong

Hi,

I would like to know how to view shutdowntime from another IP address.
I only know how to view it from my localmachine. This is my code:

 Protected Sub Button1_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles Button1.Click
        Label1.Text = GetLastSystemShutdown().ToString()
    End Sub

Public Shared Function GetLastSystemShutdown() As DateTime
    Dim sKey As String = "System\CurrentControlSet\Control\Windows"
    Dim key As Microsoft.Win32.RegistryKey = Microsoft.Win32.Registry.LocalMachine.OpenSubKey(sKey)

    Dim sValueName As String = "ShutdownTime"
    Dim val As Byte() = DirectCast(key.GetValue(sValueName), Byte())
    Dim valueAsLong As Long = BitConverter.ToInt64(val, 0)
    Return DateTime.FromFileTime(valueAsLong)
End Function

Output:

Address: ###.##.##.##
Shutdown date and time: 3/14/2013 6:04:28 PM

I don't have any idea on how to put the IP address, I need to view it's shutdown logs.
Thank you in advance.

  • 2 Contributors
  • 3 Replies
  • 255 Views
  • 6 Days Discussion Span
  • Latest Post Latest Post by jaejoong

Dani AI

Generated

As discovered, the registry value you read is local-only unless you explicitly open the remote registry hive. Two practical, commonly used approaches to get shutdown info from another machine (by IP) are:

  • Query the remote System event log for shutdown-related event IDs (recommended). Event IDs to look for: 6006 (clean shutdown), 6008 (unexpected), 1074 (process/user-initiated shutdown — message text contains the user/process). WMI or the Event Log API can retrieve these remotely and give you timestamps and the message text.
  • Read the remote registry value HKLM\SYSTEM\CurrentControlSet\Control\Windows\ShutdownTime (works but requires the Remote Registry service, admin rights, and is less descriptive than event-log entries).

Example VB.NET using WMI (works with an IP address and optional credentials). This returns EventCode, converted DateTime, and Message:

' Requires a reference to System.Management
Imports System.Management

Public Function GetShutdownEventsByIP(ip As String, Optional user As String = Nothing, Optional pwd As String = Nothing) As List(Of Tuple(Of Integer, DateTime, String))
    Dim out As New List(Of Tuple(Of Integer, DateTime, String))()
    Dim conn As New ConnectionOptions()
    If Not String.IsNullOrEmpty(user) Then
        conn.Username = user
        conn.Password = pwd
        conn.Impersonation = ImpersonationLevel.Impersonate
    End If

    Dim scope As New ManagementScope("\\" & ip & "\root\cimv2", conn)
    scope.Connect()

    Dim q As New ObjectQuery("SELECT TimeGenerated, EventCode, Message FROM Win32_NTLogEvent WHERE Logfile='System' AND (EventCode=6006 OR EventCode=6008 OR EventCode=1074)")
    Dim s As New ManagementObjectSearcher(scope, q)
    For Each mo As ManagementObject In s.Get()
        Dim t As String = Convert.ToString(mo("TimeGenerated"))
        Dim dt As DateTime = Management.ManagementDateTimeConverter.ToDateTime(t)
        Dim code As Integer = Convert.ToInt32(mo("EventCode"))
        Dim msg As String = Convert.ToString(mo("Message"))
        out.Add(Tuple.Create(code, dt, msg))
    Next
    Return out
End Function

Notes and troubleshooting:

  • The caller must have administration/WMI rights on the target host. Firewalls often block WMI/DCOM (RPC 135 + dynamic ports); enable the appropriate "Remote Management" rules or use WinRM/PowerShell remoting instead.
  • From an ASP.NET app, the app pool identity must be able to authenticate to the remote machine (use explicit credentials or configure delegation).
  • If you prefer the registry route, use RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, machineName) but ensure the Remote Registry service is running and you have admin access.

Recommended Answers

All 3 Replies

Member Avatar for lolafuertes

See here (with example)

Hope this helps

Member Avatar for jaejoong

Can I have some example please. Thank you.

Member Avatar for jaejoong

Registry is not the best solution to my problem cause it only get the data from my local machine.
Is there a way to get the shutdown date from

-Computer Management
-Connect to another computer..
-Type in IP address
and lastly, search for the shutdown logs of the user/s.

I don't know how to code it to web/pc app.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.