Windows Event ID 900 – Kernel-General: System Boot Performance Monitoring

Access the boot performance information directly through Event Viewer to understand your system's startup metrics.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. In the Actions pane, click Filter Current Log
4. Enter 900 in the Event IDs field and click OK
5. Double-click any Event ID 900 entry to view detailed boot performance data
6. Review the General tab for boot time summary and Details tab for raw performance metrics
7. Note the boot duration values and compare against your baseline performance expectations

Use PowerShell to programmatically collect and analyze boot performance metrics from Event ID 900.

1. Open PowerShell as Administrator
2. Run the following command to retrieve recent boot performance events:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=900} -MaxEvents 10 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. For detailed boot timing analysis, extract specific performance data:

$bootEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=900} -MaxEvents 30
$bootEvents | ForEach-Object {
    [PSCustomObject]@{
        Date = $_.TimeCreated
        BootTime = ($_.Message -split '\n' | Where-Object {$_ -match 'boot time'})
        EventData = $_.Properties
    }
} | Format-Table -AutoSize

4. Export boot performance data to CSV for trend analysis:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=900} -MaxEvents 100 | 
Select-Object TimeCreated, Message | 
Export-Csv -Path "C:\temp\boot_performance.csv" -NoTypeInformation

Leverage Windows Performance Monitor to create comprehensive boot performance reports and establish performance baselines.

1. Open Performance Monitor by typing perfmon in the Start menu
2. Navigate to Reports → System → System Performance
3. Right-click System Performance and select New → Data Collector Set
4. Name it "Boot Performance Monitoring" and select Create manually
5. Add the following performance counters:
• System\System Up Time
• Process(*)\Elapsed Time
• LogicalDisk(*)\% Idle Time
6. Configure the data collector to start automatically at system startup
7. Correlate Performance Monitor data with Event ID 900 timestamps for comprehensive analysis
8. Create custom reports combining boot event data with system performance metrics

Enable enhanced boot performance monitoring through registry configuration and Windows Performance Toolkit integration.

1. Open Registry Editor as Administrator
2. Navigate to HKLM\SYSTEM\CurrentControlSet\Control\Session Manager
3. Create or modify the DWORD value EnableBootPerfTracing and set it to 1
4. Navigate to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack
5. Verify that TelemetryEnabled is set to 1 for boot performance data collection
6. Install Windows Performance Toolkit (WPT) from Windows SDK
7. Use Windows Performance Recorder (WPR) to capture detailed boot traces:

wpr -start GeneralProfile -start CPU -start DiskIO

8. After system restart, stop the trace and analyze with Windows Performance Analyzer:

wpr -stop C:\temp\boot_trace.etl

9. Correlate WPA trace data with Event ID 900 timestamps for comprehensive boot analysis

Implement enterprise-scale boot performance monitoring using Event ID 900 data collection and automated alerting systems.

1. Configure Windows Event Forwarding (WEF) to centralize Event ID 900 collection:

winrm quickconfig
wecutil cs subscription.xml

2. Create a subscription XML file for Event ID 900 forwarding:

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
    <SubscriptionId>BootPerformanceMonitoring</SubscriptionId>
    <Query>
        <Select Path="System">*[System[EventID=900]]</Select>
    </Query>
</Subscription>

3. Set up PowerShell-based alerting for boot performance degradation:

$threshold = 120 # seconds
$recentBoots = Get-WinEvent -FilterHashtable @{LogName='ForwardedEvents'; Id=900} -MaxEvents 5
$slowBoots = $recentBoots | Where-Object {$_.Message -match 'boot time: ([0-9]+)' -and [int]$Matches[1] -gt $threshold}
if ($slowBoots) {
    Send-MailMessage -To "admin@company.com" -Subject "Slow Boot Alert" -Body "Boot performance threshold exceeded"
}

4. Integrate with System Center Operations Manager (SCOM) or Microsoft Sentinel for advanced monitoring
5. Create automated remediation workflows triggered by boot performance anomalies
6. Establish performance baselines and trend analysis dashboards using collected Event ID 900 data