VBS中获取系统本次及上次开关机时间的代码(WinXP/win2003/Win7兼容版)

if (lcase(right(wscript.fullname,11)) = "wscript.exe") then
createobject("wscript.shell").run("%comspec% /c " &chr(34)&"mode con cols=100&cscript.exe //nologo "&chr(34)& wscript.scriptfullname &chr(34)&"&&(echo 此窗口40秒后自动关闭...&ping -n 40 127.0.1>nul&exit)"&chr(34)),3:wscript.quit
wscript.quit
end if
set wmi = getobject("winmgmts:{impersonationlevel=impersonate}!\\.\root\cimv2")
set colloggedevents = wmi.execquery("select * from win32_ntlogevent where logfile = 'system' and eventcode = '6005' or eventcode = '6006' or eventcode = '6008'")
for each objevent in colloggedevents
flag = flag + 1
if flag = 1 then
wscript.echo "本次开机时间: " & utctonow(objevent.timewritten)
elseif (flag mod 2) = 0 then
g = utctonow(objevent.timewritten)
else
k = utctonow(objevent.timewritten)
wscript.echo "前次开机："&k&" "&vbtab&"对应关机："&g&" "&vbtab& "运行时长：" &stohms(datediff("s", k, g))
end if
next

function utctonow(nd)
if not isnull(nd) then
set swdt = createobject("wbemscripting.swbemdatetime")
swdt.value = nd
utctonow = swdt.getvardate(true)
end if
end function

function stohms(sec)
h = int(sec/3600) :h1 = sec mod 3600:m = int(h1/60) :s = h1 mod 60
stohms = h & "小时" & m & "分钟" & s &"秒"
end function