On Windows XP one can use WMI to determine when the computer booted up by querying root/cimv2/Win32_OperatingSystem.LastBootupTime. This will return a result in CIM_DATETIME format indicating the time the computer booted up. However, while researching some things yesterday I found that on XP SP2 this changes if a user logs out, puts the computer in a Hibernate or Stand-by mode, wakes the computer, then queries this value.
Here’s results of this query after a few different scenarios:
Initial Query: 20090910130529.109375-240
After Logoff / Logon: 20090910130529.109375-240
After Hibernate / Wake while Logged In: 20090910130529.109375-240
After Logoff / Hibernate / Wake / Login: 20090910131221.162894-240
After Logoff / Stand By / Wake / Login: 20090910131718.006644-240
This was quite unexpected, because Microsoft’s documentation on the Win32_OperatingSystem class states that LastBootUpTime contains “Date and time the operating system was last restarted.”, and Hibernate or Stand By shouldn’t constitute a restart.
This behavior was not observed on XP SP3. Per 946480: List of fixes that are included in Windows XP Service Pack 3 this was not something fixed, but it does appear to have changed. If you would like to demonstrate this for yourself, use the following VBScript (or download it from here: getlastbootuptimetest.vbs) to easily read out Win32_OperatingSystem.LastBootUpTime:
Option Explicit
Dim colQueryResults
Dim dteLastBootupTime
Dim objItem
Dim objWMISet objWMI = GetObject("winmgmts:root\cimv2")
Set colQueryResults = objWMI.ExecQuery("Select LastBootUpTime from Win32_OperatingSystem")
For Each objItem in colQueryResults
dteLastBootupTime = objItem.LastBootUpTime
NextIf InStr(1,Wscript.FullName,"cscript.exe",1) = 0 Then
MsgBox "Win32_OperatingSystem.LastBootupTime in CIM Format:" & vbCRLF & dteLastBootupTime, vbOKOnly, "Result!"
Else
WScript.Echo
WScript.Echo "Win32_OperatingSystem.LastBootupTime in CIM Format is:"
WScript.Echo dteLastBootupTime
End If