Powershell – Find last run defrag WMI or Reg key


I am trying to discover if there has been a defrag run on our servers. To save myself going to each one and loading the defrag program and checking the "Last Run" column I thought WMI might have this info. I have been checking the Win32_Volume class and can see this can be used to initiate defrags and run the analysis. What I can't find is any reference to the last time it completed. I would rather just pull an object down than run an analysis each time. Is there a way to find this information through WMI or a reg key?

Best Answer

Run a query for Event ID 258 in the Application event log

PS F:\ps1> get-winevent -filterHashTable @{Logname = 'Application'; ID = '258';} | select-object -first 1 -prop machinename,timecreated,message | fl

MachineName : coyote.acme.com
TimeCreated : 9/24/2014 2:28:07 AM
Message     : The disk defragmenter successfully completed defragmentation on (C:)