Loading...

A toast notification to display a warning to user if a device not rebooted since x days (even with fast startup enabled)

12 A+ A-


In this post, I will show you a Toast notification script to display a warning to user if a device has not been reboot since some days. It will work for reboot, shutdown and even if fast boot is enabled.


Issue with fast startup

Basic solution to get uptime

You can easily get the uptime of a device meaning last time the device has rebooted using the below command:

There are also some existing toast for notifying user to reboot using this method.

I admit this works like a charm unless... 


When the issue occurs ?

The issue occurs if fast startup is enabled on the device and the user shutdown the device instead of just rebooted it.

When he starts it again, the toast notification tells him his device has not been rebooted since 10 days (date of the last reoot).

If you have a schedule toast it be really annoying for the user who does not make difference between reboot and a shutdown.

 

What is the issue ?

The issue with this method is that if fast boot is enabled on a device, when the user shutdown the device (and not reboot) the time collected will be wrong.

 

Reproduce the issue

1. Go into Control Panel\All Control Panel Items\Power Options\System Settings

2. Enable the fast startup by checking below property:

2. Wait a bit like 5 minutes

3. Shutdown your device

4. Start the device

5. Use the command mentioned above

6. This won't dipslay the correct time

7. Go to Task Manager

8. It won't display the correct time either

9. Disable fast boot

10. Shutdown your device

11. Start the device

12. Check uptime

13. This dipslays the correct time

 

Get the good time ?

In order to get the good time if fast boot is enabled or not, if device has been rebooted or shutdowned, we will use event log.

The event log name to check is: Microsoft-Windows-Kernel-Boot

The event ID to check if: 27

 

See below what code mean:

- 0x0: Full shutdown or reboot

- 0x1: Shutdown with fast boot

- 0x2: Resume from hibernation

 

See below how to check for code 0x0 or 0x1:

See below returns for each case:

0x0: Full shutdown or reboot

0x1: Shutdown with fast boot



Get the script

Click on the below GitHub picture to get the Proactive Remediation script.


The toast notification

Choose button

You can choose to display a button to allow user to restart the device now.

When the user clicks on Restart now, the device will be rebooter 5 minutes after.

To display this button set the variable Show_RestartNow_Button to True.


Change text

You can easily customize text in the toast notification.

For that proceed as below:

Search fo the "Toast text part" line, see below:

You can customize there text as below:

 

Change toast picture

You can easily add your own picture in the toast.

There are two ways to configure header.

Search variable $Header_type.

If you want to use the gif I provided set this variable to gif.

The GIF will be automatically downloaded from my GitHub.

If you want to change the path of the gif set variable $URL.

If you want to use a picture converted to Base64, set variable Header_type to Base64.

See below an overview of the toast with the gif:


See below an overview of the toast with the Base64 picture:

The first step is to convert your picture to base64.

For that proceed as below:

Then copy, the code in the variable $Picture_Base64.

 

Deploy it with Proactive Remediation

1. Go to the Microsoft Endpoint Manager admin center

2. Go to Reports

3. Go to Endpoint Analytics

4. Go to Proactive Remediations

5. Click on Create script package

6. Type a name

7. Click on Next

8. Click on Detection script file

9. Browse the script LastReboot_Detection.ps1

10. Click on Remediation script file

11. Browse the script LastReboot_Remediation.ps1

12. Run the the script as user

13. Click on Next

14. Select the group

15. In the Schedule part, choose when the package should be run.

16. Click on Apply

17. Click on Next

18. Click on Create

slider 6450178498826360991

Enregistrer un commentaire

12 commentaires

Unknown a dit…

Thanks, this is a great idea! Is there any way to customize the little icon to the left of "Syst and Deploy informs you"?

Anonyme a dit…

Hi. Thanks for the script. Looks great! What pixel size should the PNG be?
Thanks again. Lex

Anonyme a dit…

Been trying to impiment this awesome script, however, we're getting the following error:

****
Exception calling "Show" with "1" argument(s): "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))" At C:\WINDOWS\IMECache\HealthScripts\610be5e8-e54f-45d6-9738-51bb46c007ee_2\remediate.ps1:145 char:1 + [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotif ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : UnauthorizedAccessException
****


Any thoughts?

Lassefar a dit…

Hi and thanks for some great work.

Is there any way of customizing the tolerances? Would like it to only start after for example 14 days.

Matt a dit…

Hi Damien, can you please tell me how can I the change the date in your scrip so Any machine (-gt) 5 days will receive a notification? and how can make it run on the all machines to find if the value above 5 days?

Thanks,
Matt

Alvaro Ondina a dit…

Hello,
When I import the Remediation Script, I see an error
"Selected file 'Last_Reboot_Remediation.ps1' must be between 1 and 200000 bytes."

How can I solve it?

Thank you.

shakti a dit…

I am getting below error when trying using proactive remediation.

Exception calling "Show" with "1" argument(s): "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))" At C:\WINDOWS\IMECache\HealthScripts\6a4b87bb-5981-44f2-b2e1-7b52b427f04b_3\remediate.ps1:202 char:1 + [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotif ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : UnauthorizedAccessException

Mac a dit…

It seems like a great solution but just as some other user reported we are getting an error with the remediation script. Seems there are not enough rights

Exception calling "Show" with "1" argument(s): "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))" At C:\WINDOWS\IMECache\HealthScripts\6a4b87bb-5981-44f2-b2e1-7b52b427f04b_3\remediate.ps1:202 char:1 + [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotif ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : UnauthorizedAccessException

Do you have any idea why this is happening?

saurabh a dit…

Great script but in windows 11, there are no logs generated for - 0x1: Shutdown with fast boot and hence it gives false results.

Any idea?
Should we disable fast boot company wide?

Anonyme a dit…

Not woring with Windows 11.
Users getting "Your device has not rebooted since 0 day(s) but with the varible configured to 10.
$Reboot_Delay = 10

Unknown a dit…

I got this error:
****
Exception calling "Show" with "1" argument(s): "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"

How to solve it?
Thanks

Mike a dit…

It looks like Windows 11 treats HKCU:\Software\Classes\AppUserModelId as a volatile parent key and it therefore cannot create a permanent subkey:

New-Item : Cannot create a stable subkey under a volatile parent key.
At line:24 char:13
+ New-Item -Path $AppRegPath -Name $AppID -Force | Out-Null
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (HKEY_CURRENT_US...My Company Team:String) [New-Item], IOException
+ FullyQualifiedErrorId : System.IO.IOException,Microsoft.PowerShell.Commands.NewItemCommand

New-ItemProperty : Cannot find path 'HKCU:\Software\Classes\AppUserModelId\My Company' because it does not exist.

I replaced line 83 with this to ensure that the subkey created is volatile and the notification is working
# New-Item -Path $AppRegPath -Name $AppID -Force | Out-Null
$hkcu = [Microsoft.Win32.RegistryKey]::OpenBaseKey('CurrentUser','default')
$a = $hkcu.OpenSubKey('Software\Classes\AppUserModelId', $true)
$a.CreateSubKey('The Crown Estate Digital Team', $true , [Microsoft.Win32.RegistryOptions]::Volatile)

Not entirely sure that using a volatile sub key is going to work well with a proactive remediation.

Accueil item

Award

Sponsors

You want to support me ?

Mes articles en français

Endpoint Manager award

Author of Books


Stats