Get-QADComputer -ComputerRole 'dc' -Service '<rootdc>' -UseGlobalCatalog | Foreach-Object{
$myserver = $_.name
$events = Get-WmiObject Win32_NTLogEvent -ComputerName $myserver -Filter "LogFile='system' AND (EventCode=6005 OR EventCode=6006)" | Where-Object {$_.ConvertToDateTime($_.TimeWritten).Month -eq 2 -and $_.ConvertToDateTime($_.TimeWritten).year -eq 2010}




if ($events | where-object {$_.eventcode -eq 6005})
	
	{
	
	$up = $events | where {$_.EventCode -eq 6005} | sort -desc {$_.ConvertToDateTime($_.TimeWritten)} | select -first 1
	$down = $events | where {$_.EventCode -eq 6006} | sort -desc {$_.ConvertToDateTime($_.TimeWritten)} | select -first 1
	
	$dom = get-wmiobject -class "Win32_computersystem" -computername $myserver

	if($up -AND $down)
		{
		$downtime = $up.ConvertToDateTime($up.TimeWritten) - $down.ConvertToDateTime($down.TimeWritten) 
		$totalminutes = [math]::Round([decimal]$downtime.TotalMinutes,0)
		$dhms = "{0}d {1}h {2}m {3}s" -f $downtime.Days,$downtime.Hours,$downtime.Minutes,$downtime.Seconds
		$dt = @{Name="Downtime";Expression={$dhms}}
		$domain = @{Name="Domain";Expression={$dom.domain}}
		$totalmin = @{Name="Total Minutes";Expression={$totalminutes}}
		$Name = @{Name="Name";Expression={$dom.name}}
		$_ | select $Name,$Domain,$dt,$totalmin
		}

	}



else 
	{
		$dom = get-wmiobject -class "Win32_computersystem" -computername $myserver
		$totalminutes = "0"
		$dhms = "0" 
		$dt = @{Name="Downtime";Expression={$dhms}}
		$domain = @{Name="Domain";Expression={$dom.domain}}
		$totalmin = @{Name="Total Minutes";Expression={$totalminutes}}
		$Name = @{Name="Name";Expression={$dom.name}}
		$_ | select $Name,$Domain,$dt,$totalmin
	}

} | export-csv down.csv -notypeinformation