Check if computer is activated through Wake On Lan

Question

I'm working on a solution where machines are activated through Wake On Lan after which System Center pushes updates to the client pc's (running Windows 7).

Now I'm working at a script (PowerShell/C#), that checks if the machine should be shutdown after the updates finishes.

If the machine is activated through Wake On Lan and no user has logged on to the machine since activation, the machine can be safely closed. Otherwise, the machine should stay on.

Is there some way to check how the computer got activated?

Outvote

If you know when you sent the WOL packet, then you could run something like github.com/pdxcat/Get-LogonHistory/blob/master/… to query the last user logon. – Lactary

I would be more curios about the fact how you determine if a update finished its installation, I just can imagine that for example an update that needs to restart once or maybe even more often does it really tell you so but now I am done after 3 hours and restarting 10 times. – Rizika

Answer 1

Since Windows 7 (maybe Vista), when you wakeup a computer "Microsoft-Windows-Power-Troubleshooter" provide a log in the System event log giving the wake up source. Here are two events (taken on Windows 8 desktop, but i've got the same ones on my Window 7 laptop), the first one was generated by a WOL, the second was generated using the front face button :

So using PowerShell you can test :

(Get-EventLog -LogName System -Source "Microsoft-Windows-Power-Troubleshooter" -AsBaseObject | Sort-Object {$_.timegenerated} | select -last 1 ).Message

This way you have to parse the message (not so good)

get-winevent -FilterHashtable @{"ProviderName"="Microsoft-Windows-Power-Troubleshooter";"id"=1}  | Sort-Object {$_.timecreated} | select -last 1 | %{([xml]$_.ToXml()).Event.EventData.Data}

Remark : Microsoft-Windows-Power-Troubleshooter provider also exists on W2K8-R2, when I try to Wake On Lan one of my old server the WakeSourceType is unknown.

Sunless

Answer 2

This might not exactly be what you're looking for, but an alternative approach:

1. On server side, remember when the WOL packet was sent
2. On client side, ask the server for the last WOL packet time
3. On client side, check the uptime of the PC, e.g. using WMI for uptime in Powershell or Codeplex Uptime
4. Compare the two. Maybe consider some delay for the hardware boot process. I don't exactly know whether uptime is counted by hardware or software.
5. For the logged on users, you can use WMI for logged on users from Powershell

Waxwing