strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
 "{impersonationLevel=impersonate}!\\" _
 strComputer  "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent " _
 "Where Logfile = 'System' And EventCode = '6005' Or EventCode = '6006'")
For Each objEvent In colLoggedEvents
  Flag = Flag + 1
  If Flag = 1 Then
    Wscript.Echo "本次開機(jī)時(shí)間: "  FormatWMIUTC(objEvent.TimeWritten)
  ElseIf Flag = 2 Then
    Wscript.Echo "上次關(guān)機(jī)時(shí)間: "  FormatWMIUTC(objEvent.TimeWritten)
  ElseIf Flag = 3 Then
    Wscript.Echo "上次開機(jī)時(shí)間: "  FormatWMIUTC(objEvent.TimeWritten)
    Exit For
  End If
Next

'FormatUTC
Function FormatWMIUTC(WMIDateString)
  DS = " // :: "
  FormatWMIUTC = Left(WMIDateString,2)
  For i = 2 To 7
    FormatWMIUTC = FormatWMIUTC  Mid(WMIDateString, i * 2 - 1, 2)  Mid(DS,i,1)
  Next
  'FormatWMIUTC = Mid(WMIDateString, 1, 4)  "年" _
  '       Mid(WMIDateString, 5, 2)  "月" _
  '       Mid(WMIDateString, 7, 2)  "日 " _
  '       Mid (WMIDateString, 9, 2)  ":" _
  '       Mid(WMIDateString, 11, 2)  ":" _
  '       Mid(WMIDateString,13, 2)
End Function