Check for unexpected reboot

check_unexpected_reboot.cmd is a Windows cmd script that checks for a reboot after a crash or power outage of a Windows machine.
It uses wevtutil.exe (Windows Vista, 2008 and up only) to read eventlog details from the command line.
It compares the dates between a normal boot and an unexpected reboot. So the alarm will always go off after an unexpected reboot and until the system has had a normal reboot. This is in order for you to do a nice chkdsk c: at boottime, which Windows refuses to do automatically.
Once a normal reboot is newer than an unexpected or the unexpected event is cleared, the alarm will go away. Use this plugin with Nsclient++ and add the following to the section [External Scripts] in NSC.ini:
check_unexpected_reboot=cmd /c scriptscheck_unexpected_reboot.cmd
Use check_nrpe to remotely check from your Nagios server

NOTE: to make the test go green again you would normally have to perform a clean reboot.
You can bypass this by sending an event with ID 13 to the eventlog.
E.g.: 'eventcreate /L system /T INFORMATION /SO "Nagios_confirm" /ID 13 /D "Unexpected reboot confirmed"'