读取 Registery 值并转换为日期

Question

我正在尝试使用以下代码查找 Windows 机器的正常运行时间（上次关机时间）：

$computernames = gc LegAservers.txt
foreach ($computername in $computernames) {
  $baseKey = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey("LocalMachine",$computername)
  $sKey = "System\CurrentControlSet\Control\Windows"
  $key = $baseKey.OpenSubKey($sKey)
  $kvalue = $key.GetValue("ShutdownTime")
  $kvalue
  "------------------------------------------"
  $baseKey.Close()
}

输出是：

$computernames = gc LegAservers.txt
foreach ($computername in $computernames) {
  $baseKey = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey("LocalMachine",$computername)
  $sKey = "System\CurrentControlSet\Control\Windows"
  $key = $baseKey.OpenSubKey($sKey)
  $kvalue = $key.GetValue("ShutdownTime")
  $kvalue
  "------------------------------------------"
  $baseKey.Close()
}

我无法隐蔽这种$kvalue在DateTime使用格式为：

[DateTime]::FromFileTime($kvalue)

请建议正确的$kvalue日期和时间格式转换方法，以便用户理解。

Answer 1

$regKey = Get-ItemProperty -Path Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Windows
$shutDown = $regKey.ShutdownTime
$Int64Value = [System.BitConverter]::ToInt64($shutDown, 0)
$date = [DateTime]::FromFileTime($Int64Value)

$date