Windows Update and Software installations will frequently create system restore points. Run this to get a list of such events:
Get-EventLog -LogName application -InstanceId 8194 | ForEach-Object {$i=1|Select-Object Event,Application; ` $i.Event, $i.Application = $_.ReplacementStrings[1,0] $i}
And this will list the command lines that actually ran after creating the restore points:
Get-EventLog -LogName application -InstanceId 8194 | ForEach-Object {$i=1|Select-Object Event,Application; ` $i.Event, $i.Application = $_.ReplacementStrings[1,0] $i} | Group-Object Application | select -ExpandProperty Name
