Check if computer is activated through Wake On Lan

Question

I'm working on a solution where machines are activated through Wake On Lan after which System Center pushes updates to the client pc's (running Windows 7).

Now I'm working at a script (PowerShell/C#), that checks if the machine should be shutdown after the updates finishes.

If the machine is activated through Wake On Lan and no user has logged on to the machine since activation, the machine can be safely closed. Otherwise, the machine should stay on.

Is there some way to check how the computer got activated?

Answer 1

Since Windows 7 (maybe Vista), when you wakeup a computer "Microsoft-Windows-Power-Troubleshooter" provide a log in the System event log giving the wake up source. Here are two events (taken on Windows 8 desktop, but i've got the same ones on my Window 7 laptop), the first one was generated by a WOL, the second was generated using the front face button :

So using PowerShell you can test :

(Get-EventLog -LogName System -Source "Microsoft-Windows-Power-Troubleshooter" -AsBaseObject | Sort-Object {$_.timegenerated} | select -last 1 ).Message

This way you have to parse the message (not so good)

get-winevent -FilterHashtable @{"ProviderName"="Microsoft-Windows-Power-Troubleshooter";"id"=1}  | Sort-Object {$_.timecreated} | select -last 1 | %{([xml]$_.ToXml()).Event.EventData.Data}

Remark : Microsoft-Windows-Power-Troubleshooter provider also exists on W2K8-R2, when I try to Wake On Lan one of my old server the WakeSourceType is unknown.