function Get-IISResetHistory { <# .SYNOPSIS Returns an OrderedDictionary that Represents the IIS Reset History. #> [CmdletBinding()] Param( $ID = 3201 ) $logLead = (Get-LogLeadName); $providerStopWatch = [System.Diagnostics.StopWatch]::StartNew() $resetDictionary = New-Object System.Collections.Specialized.OrderedDictionary $IISResetHistoryDetails = New-Object System.Collections.Specialized.OrderedDictionary try { Write-Verbose "$logLead : [$($providerStopWatch.Elapsed)] : Getting Event Log Entries for Event ID $ID" $dateLimit = (Get-Date) - (New-TimeSpan -Day 90) $resetEvents = Get-WinEvent -FilterHashtable @{ LogName = 'System' Id = $ID StartTime = $dateLimit } foreach ($event in $resetEvents) { $eventId = [string]$event.RecordId Write-Verbose "$logLead : [$($providerStopWatch.Elapsed)] : Processing RecordId $eventId" $IISResetHistoryDetails[$eventId] = New-Object System.Collections.Specialized.OrderedDictionary $IISResetHistoryDetails[$eventId]["Date"] = $event.TimeCreated; $IISResetHistoryDetails[$eventId]["Process"] = $event.Properties[0].Value; $IISResetHistoryDetails[$eventId]["Reason"] = $event.Properties[2].Value; $IISResetHistoryDetails[$eventId]["Action"] = $event.Properties[4].Value; $IISResetHistoryDetails[$eventId]["Comment"] = $event.Properties[5].Value; $IISResetHistoryDetails[$eventId]["User"] = $event.Properties[6].Value; $IISResetHistoryDetails[$eventId]["Message"] = $event.Message; } $IISResetHistoryDetails = ($IISResetHistoryDetails | sort-object )[0] } catch { $IISResetHistoryDetails["Error"] = $_.Exception.ToString() } $resetDictionary.Add("IISResetHistory", $IISResetHistoryDetails) Write-Verbose "$logLead : [$($providerStopWatch.Elapsed)] : Provider Complete" $providerStopWatch.Stop() return $resetDictionary }