General Check if Last Boot was from Fast Startup, Hibernate, Restart or Shutdown in Windows 11

# Generate timestamp for the file name
$timestamp = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

# Build the output file path on the user's Desktop
$desktopPath = [Environment]::GetFolderPath("Desktop")
$outputFile = Join-Path $desktopPath "Power Cycle Causes ($timestamp).txt"

# Get boot type events (Kernel-Boot ID 27)
$bootEvents = Get-WinEvent -FilterHashtable @{
    LogName      = 'System'
    ProviderName = 'Microsoft-Windows-Kernel-Boot'
    Id           = 27
} | Sort-Object TimeCreated

# Get all relevant power/boot/shutdown events
$powerEvents = Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Id      = 1, 12, 27, 41, 1074, 6005, 6006, 6008, 6605
} | Sort-Object TimeCreated

function Get-BootTypeText {
    param($value)
    switch ($value) {
        0 { return "0x0: This was a Cold Boot via Full Shutdown or a Restart" }
        1 { return "0x1: Hybrid Boot (Fast Startup)" }
        2 { return "0x2: Resume from Hibernation" }
        default { return "Boot type unavailable" }
    }
}

# Build sessions
$sessions = @()

# --- SESSION 1: ALWAYS include newest events from last boot to now ---
$latestBoot = $bootEvents | Select-Object -Last 1

if ($latestBoot) {
    $latestEvents = $powerEvents | Where-Object {
        $_.TimeCreated -ge $latestBoot.TimeCreated
    }

    if ($latestEvents.Count -gt 0) {
        $sessions += [PSCustomObject]@{
            BootEvent = $latestBoot
            Events    = $latestEvents
        }
    }
}

# --- OLDER SESSIONS ---
for ($i = 0; $i -lt $bootEvents.Count - 1; $i++) {

    $boot     = $bootEvents[$i]
    $nextBoot = $bootEvents[$i + 1]

    $eventsInRange = $powerEvents | Where-Object {
        $_.TimeCreated -ge $boot.TimeCreated -and $_.TimeCreated -lt $nextBoot.TimeCreated
    }

    if ($eventsInRange.Count -gt 0) {
        $sessions += [PSCustomObject]@{
            BootEvent = $boot
            Events    = $eventsInRange
        }
    }
}

# Sort sessions newest → oldest
$sessions = $sessions | Sort-Object { $_.BootEvent.TimeCreated } -Descending

# Build report
$report = ""

foreach ($session in $sessions) {

    $bootTypeValue = $session.BootEvent.Properties[0].Value
    $bootTypeText  = Get-BootTypeText $bootTypeValue

    $report += @"
Boot Type:
$bootTypeText

------------------------------------------------------------

Event Log Entries:

"@

    foreach ($ev in $session.Events | Sort-Object TimeCreated -Descending) {
        $formatted = $ev | Format-List Id, LevelDisplayName, TimeCreated, Message | Out-String
        $report += $formatted + "`n"
    }

    $report += "`n`n"
}

$report | Out-File -FilePath $outputFile -Encoding UTF8
Write-Host "Report saved to: $outputFile"

# Get boot type events (Kernel-Boot ID 27)
$bootEvents = Get-WinEvent -FilterHashtable @{
    LogName      = 'System'
    ProviderName = 'Microsoft-Windows-Kernel-Boot'
    Id           = 27
} | Sort-Object TimeCreated

# Get ALL relevant events (for correct session building)
$allEvents = Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Id      = 1, 12, 27, 41, 1074, 6005, 6006, 6008, 6605
} | Sort-Object TimeCreated

function Get-BootTypeText {
    param($value)
    switch ($value) {
        0 { return "0x0: Cold Boot / Restart" }
        1 { return "0x1: Hybrid Boot (Fast Startup)" }
        2 { return "0x2: Resume from Hibernation" }
        default { return "Unknown Boot Type" }
    }
}

# Build sessions
$sessions = @()

# Newest boot session
$latestBoot = $bootEvents | Select-Object -Last 1

if ($latestBoot) {
    $latestEvents = $allEvents | Where-Object {
        $_.TimeCreated -ge $latestBoot.TimeCreated
    }

    $sessions += [PSCustomObject]@{
        BootEvent = $latestBoot
        Events    = $latestEvents
    }
}

# Older sessions
for ($i = 0; $i -lt $bootEvents.Count - 1; $i++) {

    $boot     = $bootEvents[$i]
    $nextBoot = $bootEvents[$i + 1]

    $eventsInRange = $allEvents | Where-Object {
        $_.TimeCreated -ge $boot.TimeCreated -and $_.TimeCreated -lt $nextBoot.TimeCreated
    }

    $sessions += [PSCustomObject]@{
        BootEvent = $boot
        Events    = $eventsInRange
    }
}

# Sort newest → oldest
$sessions = $sessions | Sort-Object { $_.BootEvent.TimeCreated } -Descending

# Build GridView rows
$rows = @()

foreach ($session in $sessions) {

    $bootTypeValue = $session.BootEvent.Properties[0].Value
    $bootTypeText  = Get-BootTypeText $bootTypeValue
    $bootTime      = $session.BootEvent.TimeCreated

    $groupName = "$($bootTime.ToString('yyyy-MM-dd HH:mm:ss'))  |  $bootTypeText"

    # Add header row
    $rows += [PSCustomObject]@{
        Group       = $groupName
        Type        = "BOOT"
        TimeCreated = $bootTime
        EventID     = ""
        Message     = ""
    }

    # Only output pertinent power events
    $powerEventsOnly = $session.Events | Where-Object {
        $_.Id -in 41, 1074, 6006, 6008, 6605
    } | Sort-Object TimeCreated -Descending

    if ($powerEventsOnly.Count -eq 0) {
        $rows += [PSCustomObject]@{
            Group       = $groupName
            Type        = "INFO"
            TimeCreated = ""
            EventID     = ""
            Message     = "(No power events for this boot session)"
        }
        continue
    }

    foreach ($ev in $powerEventsOnly) {
        $rows += [PSCustomObject]@{
            Group       = $groupName
            Type        = "EVENT"
            TimeCreated = $ev.TimeCreated
            EventID     = $ev.Id
            Message     = $ev.Message
        }
    }
}

# Output to collapsible GridView
$rows | Out-GridView -Title "Power Events by Boot Session (Collapsible by Group Column)"

# Save the exact same rows to a text file
$rows | Format-Table -AutoSize | Out-String | Out-File -FilePath $outputFile -Encoding UTF8

Write-Host "Report saved to: $outputFile"