Windows Event ID 2 – Kernel-General: System Boot Completion

Navigate to Event Viewer to examine the boot completion event and gather baseline information:

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter Event ID 2 in the Event IDs field and click OK
5. Double-click the most recent Event ID 2 to view details
6. Note the timestamp and any additional data in the event description
7. Check the Details tab for XML data containing boot performance metrics

The event details will show the exact time when kernel initialization completed, which is essential for boot performance analysis.

Use PowerShell to retrieve and analyze boot completion events programmatically:

# Get the last 10 boot completion events
Get-WinEvent -FilterHashtable @{LogName='System'; Id=2} -MaxEvents 10

# Get boot events from the last 7 days with detailed formatting
Get-WinEvent -FilterHashtable @{LogName='System'; Id=2; StartTime=(Get-Date).AddDays(-7)} | 
    Select-Object TimeCreated, Id, LevelDisplayName, Message | 
    Format-Table -AutoSize

# Export boot events to CSV for analysis
Get-WinEvent -FilterHashtable @{LogName='System'; Id=2; StartTime=(Get-Date).AddDays(-30)} | 
    Select-Object TimeCreated, Id, MachineName, Message | 
    Export-Csv -Path "C:\Temp\BootEvents.csv" -NoTypeInformation

This method provides scriptable access to boot event data for automated monitoring and reporting scenarios.

Correlate Event ID 2 with shutdown events to measure complete boot cycles:

# Get shutdown and boot events to calculate boot duration
$ShutdownEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 5
$BootEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=2} -MaxEvents 5

# Calculate boot duration for the most recent cycle
if ($ShutdownEvents -and $BootEvents) {
    $LastShutdown = $ShutdownEvents[0].TimeCreated
    $LastBoot = $BootEvents[0].TimeCreated
    $BootDuration = $LastBoot - $LastShutdown
    Write-Host "Last boot duration: $($BootDuration.TotalSeconds) seconds"
}

# Get Windows boot performance data
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Diagnostics-Performance/Operational'; Id=100} -MaxEvents 5 | 
    Select-Object TimeCreated, Message

Use this approach to establish boot performance baselines and identify systems with degraded startup performance.

Deploy centralized monitoring for Event ID 2 across your Windows infrastructure:

# Create a scheduled task to monitor boot events
$Action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-Command "Get-WinEvent -FilterHashtable @{LogName=\"System\"; Id=2} -MaxEvents 1 | Export-Csv -Path \"C:\\Logs\\BootEvent.csv\" -Append"'
$Trigger = New-ScheduledTaskTrigger -AtStartup
$Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount
Register-ScheduledTask -TaskName "BootEventLogger" -Action $Action -Trigger $Trigger -Principal $Principal

# Query remote systems for boot events
$Computers = @("Server01", "Server02", "Workstation01")
foreach ($Computer in $Computers) {
    try {
        $BootEvent = Get-WinEvent -ComputerName $Computer -FilterHashtable @{LogName='System'; Id=2} -MaxEvents 1 -ErrorAction Stop
        Write-Host "$Computer last boot: $($BootEvent.TimeCreated)"
    } catch {
        Write-Warning "Failed to query $Computer: $($_.Exception.Message)"
    }
}

This method enables enterprise-wide boot monitoring and helps identify systems with startup issues.

Perform deep boot analysis using Windows Performance Analyzer and registry inspection:

# Check boot configuration in registry
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "ClearPageFileAtShutdown"
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control" -Name "WaitToKillServiceTimeout"

# Enable boot logging for detailed analysis
bcdedit /set bootlog yes

# Check fast startup configuration
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power" -Name "HiberbootEnabled"

# Analyze boot trace with Windows Performance Toolkit
# First, capture a boot trace:
wpr -start GeneralProfile -start CPU
# After reboot:
wpr -stop C:\Temp\BootTrace.etl

# Query boot optimization settings
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\OptimalLayout" -Name "EnableAutoLayout"

This advanced method provides comprehensive boot performance data for troubleshooting complex startup issues.