- powershell
get-winevent System -filterxpath "*[System[Provider[@Name='EventLog'] and (EventID='6005' or EventID='6006')]]" -maxevents 10




Get-EventLog System | select EventID,MachineName,TimeWritten,Message | ? {$_.EventID -eq 6005 -or $_.EventID -eq 6006 -or $_.EventID -eq 6008 } 

wevtutil qe system /f:text /q:"*[System[(EventID=6005 or EventID=6006)]]"


http://www.atmarkit.co.jp/ait/articles/0804/25/news171.html


wmic ntevent where "(logfile='system' and SourceName='EventLog' and TimeGenerated >='20180101' and (EventCode='6005' or EventCode='6006'))" list /format:CSV