windows eventlog Startdauer

#include <Array.au3>


#RequireAdmin


$foo1=Run(@ComSpec & ' /c wevtutil qe Microsoft-Windows-Diagnostics-Performance/Operational /q:*[System[(EventID=100)]] /rd:true /c:1', @SystemDir, @SW_HIDE,$STDERR_CHILD + $STDOUT_CHILD)
_ReadCMDOut($foo1)


Func _ReadCMDOut($CMD)
    Local $line
    While 1
        $line = StdoutRead($CMD)
		ConsoleWrite($line)
        If @error Then ExitLoop
        If $line <> "" Then
            $pBootTime = "<Data Name="&"'"&"BootTime"&"'"&">(.*?)</Data>"
            $pBootStartTime = "<Data Name="&"'"&"BootStartTime"&"'"&">(.*?)</Data>"
            $pBootEndTime = "<Data Name="&"'"&"BootEndTime"&"'"&">(.*?)</Data>"
            $pMainPathBootTime = "<Data Name="&"'"&"MainPathBootTime"&"'"&">(.*?)</Data>"
            $pBootPostBootTime = "<Data Name="&"'"&"BootPostBootTime"&"'"&">(.*?)</Data>"
            Local $aBootTime = StringRegExp($line, $pBootTime, $STR_REGEXPARRAYMATCH)
            Local $aBootStartTime = StringRegExp($line, $pBootStartTime, $STR_REGEXPARRAYMATCH)
            Local $aBootEndTime = StringRegExp($line, $pBootEndTime, $STR_REGEXPARRAYMATCH)
            Local $aMainPathBootTime = StringRegExp($line, $pMainPathBootTime, $STR_REGEXPARRAYMATCH)
            Local $aBootPostBootTime = StringRegExp($line, $pBootPostBootTime, $STR_REGEXPARRAYMATCH)
            _ArrayDisplay($aBootTime,"1")
            _ArrayDisplay($aBootStartTime,"2")
            _ArrayDisplay($aBootEndTime,"3")
            _ArrayDisplay($aMainPathBootTime,"4")
            _ArrayDisplay($aBootPostBootTime,"5")
        EndIf
    WEnd
EndFunc

#include <Array.au3>


;#RequireAdmin
Local $sUsername = "IT"
Local $sPassword = "xxxxxxx"
Local $sDomain = "lokal"


Local $foo1 = RunAs($sUserName, $sDomain, $sPassword, 0, @ComSpec & ' /c wevtutil qe Microsoft-Windows-Diagnostics-Performance/Operational /q:*[System[(EventID=100)]] /rd:true /c:1', "", @SW_SHOWDEFAULT)
;$foo1=Run(@ComSpec & ' /c wevtutil qe Microsoft-Windows-Diagnostics-Performance/Operational /q:*[System[(EventID=100)]] /rd:true /c:1', @SystemDir, @SW_HIDE,$STDERR_CHILD + $STDOUT_CHILD)
_ReadCMDOut($foo1)


Func _ReadCMDOut($CMD)
    Local $line
    While 1
        $line = StdoutRead($CMD)
		ConsoleWrite($line)
        If @error Then ExitLoop
        If $line <> "" Then
            $pBootTime = "<Data Name="&"'"&"BootTime"&"'"&">(.*?)</Data>"
            $pBootStartTime = "<Data Name="&"'"&"BootStartTime"&"'"&">(.*?)</Data>"
            $pBootEndTime = "<Data Name="&"'"&"BootEndTime"&"'"&">(.*?)</Data>"
            $pMainPathBootTime = "<Data Name="&"'"&"MainPathBootTime"&"'"&">(.*?)</Data>"
            $pBootPostBootTime = "<Data Name="&"'"&"BootPostBootTime"&"'"&">(.*?)</Data>"
            Local $aBootTime = StringRegExp($line, $pBootTime, $STR_REGEXPARRAYMATCH)
            Local $aBootStartTime = StringRegExp($line, $pBootStartTime, $STR_REGEXPARRAYMATCH)
            Local $aBootEndTime = StringRegExp($line, $pBootEndTime, $STR_REGEXPARRAYMATCH)
            Local $aMainPathBootTime = StringRegExp($line, $pMainPathBootTime, $STR_REGEXPARRAYMATCH)
            Local $aBootPostBootTime = StringRegExp($line, $pBootPostBootTime, $STR_REGEXPARRAYMATCH)
            _ArrayDisplay($aBootTime,"1")
            _ArrayDisplay($aBootStartTime,"2")
            _ArrayDisplay($aBootEndTime,"3")
            _ArrayDisplay($aMainPathBootTime,"4")
            _ArrayDisplay($aBootPostBootTime,"5")
        EndIf
    WEnd
EndFunc