Finding Start Time Degradation

With Administrator privileges, a Windows system provides access to the diagnostic data gathered during startup. Windows logs the start time and degradation times (in milliseconds) for any service and subsystem launched. With this data, you can identify potential problems with services that take too much time to launch.

Here is a script that reads the appropriate log file entries and returns the measured startup times:

#requires -RunAsAdmin

$Days = 180

$machineName = @{
    Name = 'MachineName'
    Expression = { $env:COMPUTERNAME }
}

$FileName = @{
        Name = 'FileName';
        Expression = { $_.properties[2].value }
}

$Name = @{
        Name = 'Name';
        Expression = { $_.properties[4].value }
}

$Version = @{
        Name = 'Version'
        Expression = { $_.properties[6].value }
}

$TotalTime = @{
        Name = 'TotalTime'
        Expression = { $_.properties[7].value }
}

$DegradationTime = @{
        Name = 'DegradationTime'
        Expression = { $_.properties[8].value }
}

Get-WinEvent -FilterHashtable @{
    LogName='Microsoft-Windows-Diagnostics-Performance/Operational'
    Id=101
    StartTime = (Get-Date).AddDays(-$Days)
    Level = 1,2
} |
  Select-Object -Property $MachineName, TimeCreated, 
                          $FileName, $Name, $Version, 
                          $TotalTime, $DegradationTime, Message |
  Out-GridView