@Vinod Survase, Thanks for posting in Q&A.
According to your description, I know that you are looking for some methods to check whether end user has restarted the device recently or not.
Based on my researching, I found that you can check whether end user has restarted the device via PowerShell, here are the content of script:
- Get-EventLog -LogName System |? {$_.EventID -in (6005,6006,41,1047)} | ft TimeGenerated,EventId,Message -AutoSize -wrap
Event ID 6005 should be labeled as "The event log service was started." This is synonymous with system startup.
Event ID 6006 should be labeled as "The event log service was stopped." This is synonymous with system shutdown.
Event ID 41 - this event is logged when you reboot your PC without shutting it down completely.
Event ID 1074 - this event means you manually restart the device.
Hope this can be helpful.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.