например, так:
Get-WmiObject win32_operatingsystem | select csname, @{LABEL='LastBootUpTime';EXPRESSION={$_.ConverttoDateTime($_.lastbootuptime)}}
или
Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime
или
Get-ComputerInfo | fl csname,oslastbootuptime
можно дергать системные журналы на предмет следующих событий:
1074 - System has been shutdown by a process/user
6005 - The Event log service was started
6006 - The Event log service was stopped
6008 - The previous system shutdown at time on date was unexpected
6013 - The system uptime is number seconds
Get-WinEvent -FilterHashtable @{logname = 'System'; id = 1074} -MaxEvents 3 | ft -wrap