$ErrorActionPreference= 'silentlycontinue'
$vmmServer = hostname
$runDate = (Get-Date).ToString("yyyy-MM-dd_HH.mm")
$log = "C:\temp\$runDate-VM_start_check.txt"
$clusterName = Read-host "Hyper-V Cluster name "
$daysToCheck = Read-host "Number of days to check (default 2)"
if ($daysToCheck -eq "") {
    $daysToCheck = 2
}
$eventToCheck = Read-Host "Event to check: 1- start of VM, 2- start from save state, 3-reboot from guest OS (default 1)"
switch ($eventToCheck) {
    1 {
        $eventID = 18500
        $info = "start of VM"
    }
    2 {
        $eventID = 18596
        $info = "start from save state"
    }
    3 {
        $eventID = 18514
        $info = "reboot from guest OS"
    }
    default {
        $eventID = 18500
        $info = "start of VM"
    }
}
$StartTime = (Get-Date).AddDays(-[int]$daysToCheck)
$output = Get-SCVMMServer -ComputerName $vmmServer
$hypervhosts = Get-Cluster -name $clusterName | Get-ClusterNode
Write-Host "`nChecking VMs for $info on $clusterName in last $daysToCheck day(s):"
foreach($hypervhost in $hypervhosts) {
    $eventProperties = Get-WinEvent -computername $hypervhost -FilterHashtable @{Logname="Microsoft-Windows-Hyper-V-Worker-Admin"; StartTime=$StartTime; ID=$eventID}
    $messages = $eventProperties.Message
    $i = 0
    foreach($message in $messages) {
        $physicalName = $message.split("'")
        $text = $hypervhost.Name+";"+$physicalName[1]+";"+(Get-VM -Name ($physicalName[1].Trim())).ComputerName+";"+$eventProperties.TimeCreated[$i]
        $hypervhost.Name+";"+$physicalName[1]+";"+(Get-VM -Name ($physicalName[1].Trim())).ComputerName+";"+$eventProperties.TimeCreated[$i]
        Add-Content $log $text
        $i++
    }
    if ($i -eq 0) {
        $text = $hypervhost.Name+";no VM found"
        $hypervhost.Name+";no VM found"
        Add-Content $log $text
    }
}
Write-Host "`nLog saved to $log"
Read-Host -Prompt "Press Enter to exit"