Now, I can hear what you want to yell at me: “But if you’ve got your domain set up properly, it shouldn’t be an issue! With multiple domain controllers, there’s redundancy!” You’d be partially right. There is redundancy for the domain<\/strong>. But not for the apps that connect to the domain…and prefer to speak to a specific server (e.g. for LDAP binds). For the sake of getting past this, let’s say that in my environment I know what I’m talking about and rebooting a DC without any warning is bad juju…forgetting, for a moment, that rebooting any<\/strong> production server during business hours without warning is bad juju.<\/p>\n So, moving on. Because this particular coworker, even after<\/strong> being told to let people know, went and did the same thing again the following day – I decided that action needed to be taken. We needed something that would tell us when these servers were going down – sure, monitoring helps, but if the server goes down and comes back up so quickly that your monitoring doesn’t catch it, it makes it hard.<\/p>\n So I went hunting for something that would do what I was after…and I was able to find something that was close, and then kind of smooshed it<\/em> into what I needed it to do.<\/p>\n So, here goes:<\/p>\n This is a fairly basic script, that I pared down from this one<\/a>, from when I went hunting. The comments really tell the story – it gets the last EventiD 1074 entry in the System event log, parses that and turns it into individual variables. You put in your email address for To\/From, punch in an SMTP server, and it spits out an email with the details of the EventID 1074. Pretty simple.<\/p>\n The following is the script I used. You can also download it here<\/a>.<\/p>\n Now, all we need to do is put it into a scheduled task. The scheduled task I have set runs this at startup using the local SYSTEM account. Not sure if this is the best way (and if there is a better way, please share, remembering this was a quick throw-together I did in about half an hour!)<\/p>\n The following is the XML for the scheduled task, or you can download the .xml file here<\/a>.<\/p>\n When it runs at startup (or manually, if you want it to!) the following is what you’ll get:<\/p>\n So that’s it – how to make sure you get an email when a critical server reboots and get the information you need to work out who and why!<\/p>\n","protected":false},"excerpt":{"rendered":" So, I was told that this might make a good blog post, so thought I’d be a good person and share (because that’s the kind of person I am). A bit of background: If you follow me on Twitter (and you totally should), over the last few days you may have seen me wearing my ranty pants due to some issues… Read more »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[8,38,5,328,2,7],"tags":[],"class_list":["post-1079","post","type-post","status-publish","format-standard","hentry","category-documentation","category-frustrations","category-sys-admin","category-techstuff","category-technology","category-work"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p2Tmk1-hp","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/girl-germs.com\/index.php?rest_route=\/wp\/v2\/posts\/1079","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/girl-germs.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/girl-germs.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/girl-germs.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/girl-germs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1079"}],"version-history":[{"count":6,"href":"https:\/\/girl-germs.com\/index.php?rest_route=\/wp\/v2\/posts\/1079\/revisions"}],"predecessor-version":[{"id":1974,"href":"https:\/\/girl-germs.com\/index.php?rest_route=\/wp\/v2\/posts\/1079\/revisions\/1974"}],"wp:attachment":[{"href":"https:\/\/girl-germs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1079"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/girl-germs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1079"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/girl-germs.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1079"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}# Look for the last event with EventID 1074 in the System log.\n$EventInfo = Get-WinEvent -FilterHashtable @{logname='System'; id=1074} -MaxEvents 1\n$EventInfo | ForEach-Object {\n$rv = New-Object PSObject | Select-Object Date, User, Action, Process, Reason, ReasonCode, Comment\n$rv.Date = $_.TimeCreated\n$rv.User = $_.Properties[6].Value\n$rv.Process = $_.Properties[0].Value\n$rv.Action = $_.Properties[4].Value\n$rv.Reason = $_.Properties[2].Value\n$rv.ReasonCode = $_.Properties[3].Value\n$rv.Comment = $_.Properties[5].Value\n$rv\n}\n \n \n# Set your email settings\n$From = <INSERT EMAIL ADDRESS HERE>\n$To = <INSERT EMAIL ADDRESS HERE>\n#$Cc = \"\"\n$Subject = $env:COMPUTERNAME + \" has Rebooted\"\n#My Email body contains custom properties that will differ from your system.\n$Body = \"$env:COMPUTERNAME has rebooted at $($rv.Date) by $($rv.User) `r`nReason: $($rv.Reason) ($($rv.ReasonCode)) `r`nComment:$($rv.Comment) \"\n$SMTPServer = <INSERT SMTP SERVER HERE>\n$SMTPPort = \"25\"\n \n \n# Send the email!\nSend-MailMessage -From $From -to $To -Subject $Subject -Body $Body -SmtpServer $SMTPServer<\/pre>\n<?xml version=\"1.0\" encoding=\"UTF-16\"?>\n<Task version=\"1.4\" xmlns=\"http:\/\/schemas.microsoft.com\/windows\/2004\/02\/mit\/task\">\n <RegistrationInfo>\n <Date>2016-05-26T08:09:56.24079<\/Date>\n <Author>DOMAIN\\USERNAME<\/Author>\n <\/RegistrationInfo>\n <Triggers>\n <BootTrigger>\n <Enabled>true<\/Enabled>\n <\/BootTrigger>\n <\/Triggers>\n <Principals>\n <Principal id=\"Author\">\n <UserId>S-1-5-18<\/UserId>\n <RunLevel>HighestAvailable<\/RunLevel>\n <\/Principal>\n <\/Principals>\n <Settings>\n <MultipleInstancesPolicy>IgnoreNew<\/MultipleInstancesPolicy>\n <DisallowStartIfOnBatteries>true<\/DisallowStartIfOnBatteries>\n <StopIfGoingOnBatteries>true<\/StopIfGoingOnBatteries>\n <AllowHardTerminate>true<\/AllowHardTerminate>\n <StartWhenAvailable>false<\/StartWhenAvailable>\n <RunOnlyIfNetworkAvailable>false<\/RunOnlyIfNetworkAvailable>\n <IdleSettings>\n <StopOnIdleEnd>true<\/StopOnIdleEnd>\n <RestartOnIdle>false<\/RestartOnIdle>\n <\/IdleSettings>\n <AllowStartOnDemand>true<\/AllowStartOnDemand>\n <Enabled>true<\/Enabled>\n <Hidden>false<\/Hidden>\n <RunOnlyIfIdle>false<\/RunOnlyIfIdle>\n <DisallowStartOnRemoteAppSession>false<\/DisallowStartOnRemoteAppSession>\n <UseUnifiedSchedulingEngine>false<\/UseUnifiedSchedulingEngine>\n <WakeToRun>false<\/WakeToRun>\n <ExecutionTimeLimit>PT10M<\/ExecutionTimeLimit>\n <Priority>7<\/Priority>\n <\/Settings>\n <Actions Context=\"Author\">\n <Exec>\n <Command>powershell.exe<\/Command>\n <Arguments><LOCATION OF SCRIPT><\/Arguments>\n <\/Exec>\n <\/Actions>\n<\/Task><\/pre>\n
![\"RebootEmail\"](\"https:\/\/i0.wp.com\/girl-germs.com\/wp-content\/uploads\/2016\/05\/RebootEmail.jpg?resize=445%2C252&ssl=1\")
<\/a><\/p>\n