Get-WinEvent -FilterHashtable @{
    LogName   = 'System'
    Id        = 6005
    StartTime = (Get-Date).AddDays(-30)
} | Select-Object TimeCreated