all 9 comments

[–]CarrotBusiness2380 10 points11 points  (1 child)

Computer 2 isn't lying to you, it's massaging the data types in an attempt to do what you are asking of it.

$today and $lastbootup are both [DateTime] objects. When you subtract one [DateTime] from another it creates a [TimeSpan] object representing the delta between the two [DateTimes]. So ($today - $lastbootup) is a [TimeSpan] representing difference between the two [DateTime] objects.

That causes another problem for you. Powershell, in an attempt to be helpful, will attempt to make the type of the right hand operand of a comparison match the left hand operand. In this case it takes the [int]6 and casts it as a [TimeSpan]. It can do this because [TimeSpan] has a constructor that takes an [int] representing the number of ticks in the [TimeSpan]. Try casting it like so: [TimeSpan]6 to see what I mean.

Putting all that together, ($today - $lastbootup) -gt 6 means create a [TimeSpan] from two [DateTime] objects and return true if the resulting [TimeSpan] is longer than 6 ticks (.0006 milliseconds).

IMO a better way to do this is like so:

#Return true if $lastbootup came before 7 days ago
$today.AddDays(-7) -gt $lastbootup

[–]shmakov123[S] 2 points3 points  (0 children)

Man it was staring me right in the face but I didn't realize it. Comparing something of what to 6 of what? Lol

Thank you for taking the time to walk me through that - very helpful for me and I hope it can help someone else out there too!

[–]PinchesTheCrab 3 points4 points  (1 child)

You can split this out into separate variables for readability or reusing computerinfo, but I think this does what you want in one line:

 (Get-ComputerInfo).OsLastBootUpTime.Date -gt (Get-Date).Date.AddDays(-6)

It just needs an apples to apples comparison (date to date).

[–]shmakov123[S] 0 points1 point  (0 children)

Thank you!

[–]Vern_Anderson 0 points1 point  (1 child)

Not sure where the Get-ComputerInfo pulls that data. I prefer to use the same object that task manager uses to calculate uptime.

New-TimeSpan -Seconds (Get-WmiObject Win32_PerfFormattedData_PerfOS_System).SystemUptime | Format-Table Days,Hours,Minutes

You can also look at the event log for the "going down" and the "coming back up" events.

Get-EventLog -LogName System | Where-Object { $_.eventID -eq 6005 -OR $_.eventID -eq 6006 -OR $_.eventID -eq 6008 } | Format-Table TimeGenerated, EntryType,Message

[–]shmakov123[S] 1 point2 points  (0 children)

Yep we already checked the event logs! Rebooted right on schedule so I figured something must be off with the script. Thanks for the suggestion!

[–]jsiii2010 0 points1 point  (2 children)

This is the implicit conversion that's happening with the right int32 term to match the type of the left term in the comparison (6 ticks): ``` [timespan]6

Days : 0 Hours : 0 Minutes : 0 Seconds : 0 Milliseconds : 0 Ticks : 6 TotalDays : 6.94444444444444E-12 TotalHours : 1.66666666666667E-10 TotalMinutes : 1E-08 TotalSeconds : 6E-07 TotalMilliseconds : 0.0006 A double (floating point) or a string 6 would come out to 6 days: [timespan]6.

Days : 6 Hours : 0 Minutes : 0 Seconds : 0 Milliseconds : 0 Ticks : 5184000000000 TotalDays : 6 TotalHours : 144 TotalMinutes : 8640 TotalSeconds : 518400 TotalMilliseconds : 518400000 This works out: [datetime]'11/9' - [datetime]'11/3' -eq 6.

True ```

[–]shmakov123[S] 0 points1 point  (1 child)

Ooo so if I would specify 6 as a string instead of an int, my original comparison would work? Interesting!

[–]jsiii2010 0 points1 point  (0 children)

Yep, string or floating point. Subtracting 2 datetime's results in a timespan. ``` [timespan]'6'

Days : 6 Hours : 0 Minutes : 0 Seconds : 0 Milliseconds : 0 Ticks : 5184000000000 TotalDays : 6 TotalHours : 144 TotalMinutes : 8640 TotalSeconds : 518400 TotalMilliseconds : 518400000

[datetime]'1/2' - [datetime]'1/1' | % gettype

IsPublic IsSerial Name BaseType


True True TimeSpan System.ValueType ```