Powershell – How to view the version of Windows 10 on a remote computer

powershellwindows 10windows-server-2012-r2

From Windows Server 2012 R2, I'd like to view which workstations on my network have been updated to Windows 10 Versions 1511, 1607 and so on.

Just to clarify, 1511 and 1607 are the numbers that I'm looking for.

I don't want to sign in to each workstation (I might have 50 or more). I don't care so much about the Edition or Build Number unless those can somehow be used to easily determine the Version.

Best Answer

There are a number of ways you could do this.

For each computer in Active Directory, its version of Windows is stored as an attribute named operatingSystemVersion.

You can query this from AD with a PowerShell command:

Get-ADComputer -Filter * -Property operatingsystemversion | select name,operatingsystemversion

This will return the name and OS version of every computer in AD.

You could also query this information directly from your computers using the win32_operatingsystem WMI class, but the method above is easier.

Related Solutions

Windows Server – Restart/Shutdown History

The clearest most succinct answer I could find is:

How To See PC Startup And Shutdown History In Windows

which lists these event ids to monitor (quoted but edited and reformatted from article):

Event ID 6005 (alternate): “The event log service was started.” This is synonymous to system startup.
Event ID 6006 (alternate): “The event log service was stopped.” This is synonymous to system shutdown.
Event ID 6008 (alternate): "The previous system shutdown was unexpected." Records that the system started after it was not shut down properly.
Event ID 6009 (alternate): Indicates the Windows product name, version, build number, service pack number, and operating system type detected at boot time.
Event ID 6013: Displays the uptime of the computer. There is no TechNet page for this id.

Add to that a couple more from the Server Fault answers listed in my OP:

Event ID 1074 (alternate): "The process X has initiated the restart / shutdown of computer on behalf of user Y for the following reason: Z." Indicates that an application or a user initiated a restart or shutdown.
Event ID 1076 (alternate): "The reason supplied by user X for the last unexpected shutdown of this computer is: Y." Records when the first user with shutdown privileges logs on to the computer after an unexpected restart or shutdown and supplies a reason for the occurrence.

Did I miss any?

Powershell – Export Firewall Rules using PowerShell that include Program Path

So Get-NetFirewallRule actually returns special objects. Some of the object's properties can only be accessed with associated Get-NetFirewall* commands.

For application information, pipe the object into Get-NetFirewallApplicationFilter

https://technet.microsoft.com/en-us/library/jj554860%28v=wps.630%29.aspx

PS C:\Users\Neil> get-netfirewallrule '{1A26910B-1B3B-4091-81E2-E3C7CBF02F45}' | get-netfirewallapplicationfilter


Program : C:\Program Files\MyProgram\thisProgram.exe
Package :

Best Answer

Related Solutions

Windows Server – Restart/Shutdown History

Powershell – Export Firewall Rules using PowerShell that include Program Path

Related Topic