Press "Enter" to skip to content

Changing Win32_OperatingSystem.LastBootupTime Result on XP SP2 after Stand-By or Hibernate

On Windows XP one can use WMI to determine when the computer booted up by querying root/cimv2/Win32_OperatingSystem.LastBootupTime. This will return a result in CIM_DATETIME format indicating the time the computer booted up. However, while researching some things yesterday I found that on XP SP2 this changes if a user logs out, puts the computer in a Hibernate or Stand-by mode, wakes the computer, then queries this value.

Here’s results of this query after a few different scenarios:

Initial Query: 20090910130529.109375-240
After Logoff / Logon: 20090910130529.109375-240
After Hibernate / Wake while Logged In: 20090910130529.109375-240
After Logoff / Hibernate / Wake / Login: 20090910131221.162894-240
After Logoff / Stand By / Wake / Login: 20090910131718.006644-240

This was quite unexpected, because Microsoft’s documentation on the Win32_OperatingSystem class states that LastBootUpTime contains “Date and time the operating system was last restarted.”, and Hibernate or Stand By shouldn’t constitute a restart.

This behavior was not observed on XP SP3. Per 946480: List of fixes that are included in Windows XP Service Pack 3 this was not something fixed, but it does appear to have changed. If you would like to demonstrate this for yourself, use the following VBScript (or download it from here: getlastbootuptimetest.vbs) to easily read out Win32_OperatingSystem.LastBootUpTime:

Option Explicit

Dim colQueryResults
Dim dteLastBootupTime
Dim objItem
Dim objWMI

Set objWMI = GetObject("winmgmts:root\cimv2")

Set colQueryResults = objWMI.ExecQuery("Select LastBootUpTime from Win32_OperatingSystem")

For Each objItem in colQueryResults
    dteLastBootupTime = objItem.LastBootUpTime

If InStr(1,Wscript.FullName,"cscript.exe",1) = 0 Then
    MsgBox "Win32_OperatingSystem.LastBootupTime in CIM Format:" & vbCRLF & dteLastBootupTime, vbOKOnly, "Result!"
    WScript.Echo "Win32_OperatingSystem.LastBootupTime in CIM Format is:"
    WScript.Echo dteLastBootupTime
End If

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.