Detect if system has restarted

[bourny 0]

Is there a way to check if the OS / machine has been fully rebooted. I am starting a script up from the registry Run key so when the user logs on the script executes and checks what stage it is upto. It appears my installation needs a reboot to take affect. Is there a way to check if the machine has been rebooted since the scriot was last ran.

Many Thanks

[KaFu 189]

I guess via WMI. As far as I remember there's somewhere a parameter SystemUpTime or something like that.

[trancexx 921]

Is there a way to check if the OS / machine has been fully rebooted. I am starting a script up from the registry Run key so when the user logs on the script executes and checks what stage it is upto. It appears my installation needs a reboot to take affect. Is there a way to check if the machine has been rebooted since the scriot was last ran.

Many Thanks

You could create some file and delete it using function MoveFileEx from kernel32.dll with flag MOVEFILE_DELAY_UNTIL_REBOOT. And just check for existance of that file. If it isn't there, the system was restarted. You could verify it by reading HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\

Session Manager\PendingFileRenameOperations in case you are afraid that someone would manually delete that file before restart. There would be no mention of your file after restart there.

Edited January 27, 2009 by trancexx

[KaFu 189]

Or you could use the forums search function...

http://www.autoitscript.com/forum/index.ph...mp;#entry597925

[bourny 0]

Or you could use the forums search function...

http://www.autoitscript.com/forum/index.ph...mp;#entry597925

I tried searching but couldnt find what I wanted hence the reason for posting this topic.

Does the topic you posted not just tell me the uptime. I am not interested in the uptime I want to find out if the computer has been rebooted since the program was last ran. I might reboot the machine but leave it on for 5 days without logging on - This would then not give me a good scenario . I am looking currently at the following.

Input program restart into HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run on all occasions apart from when a function requires a restart then delete the above program from Run and input it into

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

According to the Web this is ran at boot up but I am testing this now.

Any other ideas appreciated

[bourny 0]

Ok that didnt work - the entry is still in the RunServices after a restart so I need to look at the usage of that key in a bit more depth ...

Any other ideas ????

[KaFu 189]

On startup write time to ini or registry and than check against mentioned function...

[bourny 0]

On startup write time to ini or registry and than check against mentioned function...

I dont get how this will tell me if the system has restarted. ?? As I said before lets say I write the uptime using this function to the reg and it is 10 hours. The machine reboots and the user loggs on and leaves the machine at the login prompt for 20 hours this then does not tell me the machine has rebooted.

Am I misunderstanding your logic.??

[KaFu 189]

I am not interested in the uptime I want to find out if the computer has been rebooted since the program was last ran.

On startup of program

read timestamp_old from registry

write timestamp_new to registry

Call function

if timestamp_old older then Call function then

computer was restarted

else

computer was not restarted

endif

? This presumes there is a value in the reg. Decided what to do if it is not present (e.g. on first run), do nothing, run manually / add value manually.

[Inverted 5]

Why not what trancexx suggested ?

[trancexx 921]

Try this:

#RequireAdmin; Vista requirement

$MOVEFILE_DELAY_UNTIL_REBOOT = 4

$sFile = @TempDir & "\{AD1C9A9B-82FF-44B1-8CCD-CD54549C719D}"
$sRegRead = RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager", "PendingFileRenameOperations")

If FileExists($sFile) Or StringInStr($sRegRead, "{AD1C9A9B-82FF-44B1-8CCD-CD54549C719D}") Then
    MsgBox(0, 'Info', 'System was not restarted since last time you run this script')
Else
    MsgBox(0, 'Info', 'You are running this script for the first time since last system restart')
EndIf

$hFile = FileOpen($sFile, 10)
FileClose($hFile)

$a_iCall = DllCall("kernel32.dll", "int", "MoveFileEx", "str", $sFile, "ptr", 0, "dword", $MOVEFILE_DELAY_UNTIL_REBOOT)

If @error Or Not $a_iCall[0] Then
    MsgBox(0, 'Error', "Error occured" & @CRLF & "Required action couldn't be performed")
EndIf   

FileDelete($sFile)

[KaFu 189]

Try this:

That's by any means a nice piece of code ... will go into SMF

Cheers

[bourny 0]

Try this:

#RequireAdmin; Vista requirement

$MOVEFILE_DELAY_UNTIL_REBOOT = 4

$sFile = @TempDir & "\{AD1C9A9B-82FF-44B1-8CCD-CD54549C719D}"
$sRegRead = RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager", "PendingFileRenameOperations")

If FileExists($sFile) Or StringInStr($sRegRead, "{AD1C9A9B-82FF-44B1-8CCD-CD54549C719D}") Then
    MsgBox(0, 'Info', 'System was not restarted since last time you run this script')
Else
    MsgBox(0, 'Info', 'You are running this script for the first time since last system restart')
EndIf

$hFile = FileOpen($sFile, 10)
FileClose($hFile)

$a_iCall = DllCall("kernel32.dll", "int", "MoveFileEx", "str", $sFile, "ptr", 0, "dword", $MOVEFILE_DELAY_UNTIL_REBOOT)

If @error Or Not $a_iCall[0] Then
    MsgBox(0, 'Error', "Error occured" & @CRLF & "Required action couldn't be performed")
EndIf   

FileDelete($sFile)

Thanks for that - Looks like what I am looking for ....

Many thnaks for all your help people

[trancexx 921]

Thanks for that - Looks like what I am looking for ....

Many thnaks for all your help people

I'm sure that you would have no problem making function out of that, but for those who might:

expandcollapse popup

#RequireAdmin ; Vista requirement

Global $iCheck = _CheckIfSystemRestartedSinceLastRun()

If @error Then
    MsgBox(48, "Error", "Function failed")
Else
    If $iCheck Then
        MsgBox(64, "Info", "You are running this script for the first time since last system restart")
    Else
        MsgBox(64, "Info", "System was not restarted since last time you run this script")
    EndIf
EndIf



Func _CheckIfSystemRestartedSinceLastRun()

    Local $sFile = @TempDir & "\{485D7FB9-BAED-489E-87C5-A15A5AF82CE3}" ; Random name, make sure that is unique.
    Local $sRegRead = RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager", "PendingFileRenameOperations")

    If StringInStr($sRegRead, "{485D7FB9-BAED-489E-87C5-A15A5AF82CE3}") Then
        Return SetError(0, 0, 0) ; System was not restarted.
    EndIf

    Local $hFile = FileOpen($sFile, 10)
    FileClose($hFile)

    Local $a_iCall = DllCall("kernel32.dll", "int", "MoveFileEx", "str", $sFile, "ptr", 0, "dword", 4)

    If @error Or Not $a_iCall[0] Then
        FileDelete($sFile)
        Return SetError(1, 0, 0) ; Raising error. If DllCall() failed, the whole funtion failed.
    EndIf

    FileDelete($sFile)

    Return SetError(0, 0, 1) ; First run after restart.

EndFunc

... only "problem" is #RequireAdmin part.

[bourny 0]

I'm sure that you would have no problem making function out of that, but for those who might:

expandcollapse popup

#RequireAdmin ; Vista requirement

Global $iCheck = _CheckIfSystemRestartedSinceLastRun()

If @error Then
    MsgBox(48, "Error", "Function failed")
Else
    If $iCheck Then
        MsgBox(64, "Info", "You are running this script for the first time since last system restart")
    Else
        MsgBox(64, "Info", "System was not restarted since last time you run this script")
    EndIf
EndIf



Func _CheckIfSystemRestartedSinceLastRun()

    Local $sFile = @TempDir & "\{485D7FB9-BAED-489E-87C5-A15A5AF82CE3}" ; Random name, make sure that is unique.
    Local $sRegRead = RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager", "PendingFileRenameOperations")

    If StringInStr($sRegRead, "{485D7FB9-BAED-489E-87C5-A15A5AF82CE3}") Then
        Return SetError(0, 0, 0) ; System was not restarted.
    EndIf

    Local $hFile = FileOpen($sFile, 10)
    FileClose($hFile)

    Local $a_iCall = DllCall("kernel32.dll", "int", "MoveFileEx", "str", $sFile, "ptr", 0, "dword", 4)

    If @error Or Not $a_iCall[0] Then
        FileDelete($sFile)
        Return SetError(1, 0, 0) ; Raising error. If DllCall() failed, the whole funtion failed.
    EndIf

    FileDelete($sFile)

    Return SetError(0, 0, 1) ; First run after restart.

EndFunc

... only "problem" is #RequireAdmin part.

Thanks Again ...

1 question and 1 observation to possibly improve.

Observation

========

I have tried the first script you posted and tried to understand how it works. I let the script run and on a reboot . I then logged in as a different user to what the script was run in (This might happen in my network) The system flagged a prompt to choose a different user to relaunch the script. I looked at the script and decided it possibly due to the file being put in @temp hence this is a profile temp folder. In my guessing wisdom I changed this to c:\detectReboot.txt. This now works better as it is does not winge that the file it is trying to handle is in a different user profile.

Question

=====

My question now stands with the fact it runs everytime the machine reboots. I did not state this in the first post but I would like to beable to disable the file running when I am satisfied I have been rebooted. I gues the answer to this is in the DllCall("kernel32.dll", line but I do not understand how this script works fully...

[trancexx 921]

Thanks Again ...

1 question and 1 observation to possibly improve.

Observation

========

I have tried the first script you posted and tried to understand how it works. I let the script run and on a reboot . I then logged in as a different user to what the script was run in (This might happen in my network) The system flagged a prompt to choose a different user to relaunch the script. I looked at the script and decided it possibly due to the file being put in @temp hence this is a profile temp folder. In my guessing wisdom I changed this to c:\detectReboot.txt. This now works better as it is does not winge that the file it is trying to handle is in a different user profile.

Question

=====

My question now stands with the fact it runs everytime the machine reboots. I did not state this in the first post but I would like to beable to disable the file running when I am satisfied I have been rebooted. I gues the answer to this is in the DllCall("kernel32.dll", line but I do not understand how this script works fully...

To tell you the truth I did not understand observation nor question. But don't worry about that, it's probably just me.

I will explain how it works, maybe that helps you:

1. File with some random unique (for this script) name is created. Location of that file is, should be, irrelevant.

2. Check if HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations have input with file's name. This is done because MoveFileEx function writes there. When system starts up it reads from there for files to rename or delete. This is used when there are updates and files needs to be replaced but couln't because they are in use (antivirus update, system update etc...). After they are renamed or deleted that registry key is deleted - this got nothing to do with us.

3. Call MoveFileEx to delete (rename) file at next startup.

4. Delete file. This is done not to leave garbage after us (not needed because it would be automatically done at next startup but nevertheless).

5. If everything is OK, return 1.

Edited January 28, 2009 by trancexx

[Darktan 0]

Why couldn't you just search the event log for event 6009? That's a server reboot.