Windows Event ID 6009 – EventLog: Microsoft Windows Kernel Boot Information

Access the Event Viewer to examine boot information and system configuration details captured by Event ID 6009.

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → System
3. In the Actions pane, click Filter Current Log
4. Enter 6009 in the Event IDs field and click OK
5. Double-click any Event ID 6009 entry to view detailed system information
6. Review the General tab for processor count, memory size, and architecture details
7. Check the Details tab for raw XML data containing additional system parameters

Use PowerShell to retrieve and analyze Event ID 6009 entries for system monitoring and inventory purposes.

1. Open PowerShell as Administrator
2. Run the following command to get recent boot events:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=6009} -MaxEvents 10 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. For detailed hardware information extraction:

   $bootEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6009} -MaxEvents 5
   foreach ($event in $bootEvents) {
       Write-Host "Boot Time: $($event.TimeCreated)"
       Write-Host "Message: $($event.Message)"
       Write-Host "---"
   }

4. To export boot information to CSV for inventory tracking:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=6009} -MaxEvents 50 | Select-Object TimeCreated, Message | Export-Csv -Path "C:\temp\boot_inventory.csv" -NoTypeInformation

Implement monitoring to track boot frequency, detect hardware changes, and identify system stability issues.

1. Create a PowerShell script to analyze boot patterns:

   $bootEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6009} -MaxEvents 100
   $bootTimes = $bootEvents | Select-Object TimeCreated
   $bootCount = $bootTimes.Count
   $daysSinceFirst = (Get-Date) - $bootTimes[-1].TimeCreated
   $avgBootsPerDay = [math]::Round($bootCount / $daysSinceFirst.TotalDays, 2)
   Write-Host "Total boots in period: $bootCount"
   Write-Host "Average boots per day: $avgBootsPerDay"

2. Check for hardware configuration changes by comparing recent events:

   $recentBoots = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6009} -MaxEvents 5
   $uniqueConfigs = $recentBoots | Group-Object Message
   if ($uniqueConfigs.Count -gt 1) {
       Write-Warning "Hardware configuration changes detected!"
       $uniqueConfigs | ForEach-Object { Write-Host $_.Name }
   }

3. Set up a scheduled task to log boot information to a central location for enterprise monitoring

Parse Event ID 6009 XML data to extract specific hardware parameters for automated inventory and compliance reporting.

1. Use PowerShell to extract structured data from the event XML:

   $bootEvent = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6009} -MaxEvents 1
   $xml = [xml]$bootEvent.ToXml()
   $eventData = $xml.Event.EventData.Data
   foreach ($data in $eventData) {
       Write-Host "$($data.Name): $($data.'#text')"
   }

2. Create a comprehensive hardware inventory function:

   function Get-BootHardwareInfo {
       $bootEvent = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6009} -MaxEvents 1
       $message = $bootEvent.Message
       
       # Parse processor and memory info from message
       if ($message -match 'processor\(s\), (\d+) MB') {
           $memory = $matches[1]
           Write-Host "Total Memory: $memory MB"
       }
       
       return @{
           BootTime = $bootEvent.TimeCreated
           ComputerName = $env:COMPUTERNAME
           Message = $message
       }
   }

3. Integrate with enterprise monitoring systems by exporting to JSON or XML formats for SIEM consumption

Perform advanced analysis by correlating Event ID 6009 with other boot-related events for comprehensive system health monitoring.

1. Create a comprehensive boot analysis script:

   $startDate = (Get-Date).AddDays(-30)
   $bootEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6009; StartTime=$startDate}
   $shutdownEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074; StartTime=$startDate} -ErrorAction SilentlyContinue
   
   Write-Host "Boot Analysis for last 30 days:"
   Write-Host "Total boots: $($bootEvents.Count)"
   Write-Host "Planned shutdowns: $($shutdownEvents.Count)"
   
   # Calculate average boot time by looking at time between shutdown and next boot
   for ($i = 0; $i -lt $shutdownEvents.Count; $i++) {
       $shutdown = $shutdownEvents[$i]
       $nextBoot = $bootEvents | Where-Object { $_.TimeCreated -gt $shutdown.TimeCreated } | Select-Object -First 1
       if ($nextBoot) {
           $downtime = $nextBoot.TimeCreated - $shutdown.TimeCreated
           Write-Host "Downtime: $($downtime.TotalMinutes) minutes"
       }
   }

2. Set up automated alerting for unusual boot patterns:

   $recentBoots = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6009} -MaxEvents 10
   $bootTimes = $recentBoots | ForEach-Object { $_.TimeCreated }
   $intervals = @()
   for ($i = 0; $i -lt $bootTimes.Count - 1; $i++) {
       $interval = ($bootTimes[$i] - $bootTimes[$i+1]).TotalHours
       $intervals += $interval
   }
   $avgInterval = ($intervals | Measure-Object -Average).Average
   if ($avgInterval -lt 1) {
       Write-Warning "Frequent reboots detected - possible system instability"
   }

3. Configure Windows Event Forwarding to centralize Event ID 6009 collection across multiple systems for enterprise-wide boot monitoring