Nodes that are managed via WMI gather the last boot value from the "LastBootUpTime" under Win32_OperatingSystem of the CIMv2 namespace. It's a calculated value but the following site should help you make sense of it. http://www.computerperformance.co.uk/powershell/powershell3-check-uptime.htm