The "Did You Actually Reboot?" Uptime Verifier

How To Write A Uptime Checking Script

5 min. read

The Ticket: The Hibernation Lie

We get this call every single week. A client reaches out complaining that their laptop is running like molasses, Excel is crashing, and the fan sounds like a jet engine. You ask the golden question: "Did you restart it today?" They swear up and down they rebooted it right before calling you. You remote in, and the system feels sluggish. Users frequently confuse closing the laptop lid or clicking "Shut down" with a true system restart. We need a fast way to verify the literal hardware uptime and catch them in the act without starting an argument.

Pre-Flight Check

• Permissions: Standard user rights. Querying basic WMI system information does not require local administrator privileges.
• Tools: PowerShell.
• Impact: Zero. This is a read-only script that makes no system changes.

[!WARNING] The Risk Factor: There is no risk of breaking the OS with this command. However, there is a high risk of annoying your client if you call them a liar outright. Use this data to gently educate them on how modern Windows power states work rather than using it as a "gotcha."

The Solution: The Uptime Script

Taking a look at the script referenced in image_66cfc4.png, it provides a solid foundation using the Get-CimInstance cmdlet. However, the screenshot cuts off the final syntax for the warning color. I have corrected the formatting below so it executes cleanly in your terminal.

PowerShell

# *** 404 & More: The True Uptime Checker ***

$bootTime = (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
$uptime = (Get-Date) - $bootTime
Write-Host "System Uptime: $($uptime.Days) Days, $($uptime.Hours) Hours" -ForegroundColor Cyan

if ($uptime.Days -gt 14) {
    Write-Host "Warning: Uptime exceeds 14 days. A reboot is highly recommended." -ForegroundColor Red
}

The "Why" (Root Cause)

Why do users think they rebooted when they actually did not? The biggest culprit is a feature Microsoft introduced back in Windows 8 called Fast Startup.

By default, when a user clicks "Shut down" in the Windows start menu, the computer does not actually turn off completely. Windows closes the user session but hibernates the Windows kernel and system state to the hard drive. When they press the power button the next morning, Windows simply loads that hibernated kernel back into RAM. To the user, it looks like a fresh boot. To the operating system, the uptime counter just keeps ticking upwards. Only a literal click on the "Restart" button forces Windows to completely dump the kernel and start from scratch.

Under the Hood (Technical Deep Dive)

The script uses Get-CimInstance to query the Win32_OperatingSystem WMI class. We are specifically pulling the LastBootUpTime property.

Why use CIM instead of the older Get-WmiObject? Get-WmiObject relies on DCOM (Distributed Component Object Model), which is older, slower, and frequently blocked by modern firewalls. Get-CimInstance uses WS-Man (Web Services-Management) and WinRM, making it the modern standard for querying system data, especially if you want to modify this script to query remote machines across a network.

RMM & Automation Tips

• The Nag Script: Take this exact script and deploy it as a scheduled task via your RMM. Set it to run every Friday at 3:00 PM. Change the Write-Host output to trigger a native Windows Toast Notification. If the uptime is greater than 14 days, a polite pop-up appears in the corner of the user's screen reminding them to leave their machine on and perform a proper "Restart" before they leave for the weekend.

Troubleshooting & Edge Cases

• Edge Case 1: WMI Corruption. If the script throws a wall of red text stating the class is invalid or the RPC server is unavailable, the local WMI repository is corrupted. You can usually bypass this by checking the uptime via the standard command prompt using net statistics workstation, but the machine will eventually need a WMI rebuild.
• Edge Case 2: Disabling Fast Startup. If you have a fleet of laptops constantly suffering from weird driver glitches because users never click "Restart", kill Fast Startup entirely. You can push a Group Policy or an RMM registry script to set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power\HiberbootEnabled to 0. Shutting down will take a few seconds longer, but your helpdesk tickets will drop dramatically.

If you want to see more guides, automation scripts, and technical deep dives just like this, make sure to follow us on Twitter, check out our Facebook page, and sign up for the weekly 404 & More newsletter!