核心代码：
strComputer = \”.\”
Set objWMIService = GetObject(\”winmgmts:\” _
& \”{impersonationLevel=impersonate}!\\\\\” _
& strComputer & \”\\root\\cimv2\”)
Set colLoggedEvents = objWMIService.ExecQuery _
(\”Select * from Win32_NTLogEvent \” _
& \”Where Logfile = \’System\’ And EventCode = \’6005\’ Or EventCode = \’6006\’\”)
For Each objEvent In colLoggedEvents
Flag = Flag + 1
If Flag = 1 Then
Wscript.Echo \”本次开机时间: \” & FormatWMIUTC(objEvent.TimeWritten)
ElseIf Flag = 2 Then
Wscript.Echo \”上次关机时间: \” & FormatWMIUTC(objEvent.TimeWritten)
ElseIf Flag = 3 Then
Wscript.Echo \”上次开机时间: \” & FormatWMIUTC(objEvent.TimeWritten)
Exit For
End If
Next
\’FormatUTC
Function FormatWMIUTC(WMIDateString)
DS = \” // :: \”
FormatWMIUTC = Left(WMIDateString,2)
For i = 2 To 7
FormatWMIUTC = FormatWMIUTC & Mid(WMIDateString, i * 2 – 1, 2) & Mid(DS,i,1)
Next
\’FormatWMIUTC = Mid(WMIDateString, 1, 4) & \”年\” _
\’ & Mid(WMIDateString, 5, 2) & \”月\” _
\’ & Mid(WMIDateString, 7, 2) & \”日 \” _
\’ & Mid (WMIDateString, 9, 2) & \”:\” _
\’ & Mid(WMIDateString, 11, 2) & \”:\” _
\’ & Mid(WMIDateString,13, 2)
End Function
将上面的代码保存为vbs后缀的文件，双击运行即可。看到这次的开机时间，上次的开关机时间。
