How to Query and Audit Windows Reliability History in Windows 11 Using PowerShell

When Windows 11 experiences intermittent software crashes, blue-screen driver faults (BSODs), or unannounced application hangs, diagnosing the root cause through Windows Event Viewer can feel overwhelming due to the sheer volume of thousands of disparate event logs. To present a unified, chronological timeline of critical system failures, Windows maintains an underlying diagnostic engine known as the Reliability Monitor.

While the graphical Reliability Monitor (perfmon /rel) displays a visual graph plotting a daily 1-to-10 system stability index, IT administrators and automated support scripts require programmatic access to these metrics. Using PowerShell and Common Information Model (CIM) cmdlets, you can query, filter, and export the complete reliability database across local or remote Windows 11 machines. This guide demonstrates how to audit Windows reliability records and stability history using PowerShell.

---

Why Audit Reliability History via PowerShell?

Querying the Windows Reliability subsystem via PowerShell provides significant diagnostic advantages:

• Chronological Failure Correlation: Reliability records automatically link application crashes to recently installed Windows updates, device driver changes, or software patches that occurred immediately beforehand.
• Automated Stability Scoring: Windows calculates a daily System Stability Index ranging from 1 (severe instability) to 10 (peak reliability). PowerShell can retrieve this metric to evaluate fleet health across corporate endpoints.
• Targeted Crash Filtering: You can isolate crashes for specific software (such as Outlook, Chrome, or custom internal enterprise tools) across any date range without parsing gigabytes of raw event logs.
• Headless Fleet Auditing: Using PowerShell Remoting, support teams can diagnose user workstations silently in the background without taking over the user’s desktop display.

---

Step 1: Open PowerShell with Administrative Privileges

Querying the WMI/CIM reliability classes requires local administrative access:

1. Right-click the Start button on your Windows 11 taskbar (or press Win + X).
2. Select Terminal (Admin) or PowerShell (Admin).
3. Click Yes when prompted by the User Account Control (UAC) security dialogue.

---

Step 2: Query Recent Failure Records Using Win32_ReliabilityRecords

Windows records all notable reliability events (application crashes, Windows Update installations, hardware failures, and dirty shutdowns) inside the Win32_ReliabilityRecords CIM class.

Execute the following command to retrieve events from the past 7 days:

$CutoffDate = (Get-Date).AddDays(-7)

Get-CimInstance -ClassName Win32_ReliabilityRecords |
    Where-Object { $_.TimeGenerated -ge $CutoffDate } |
    Select-Object TimeGenerated, EventIdentifier, SourceName, Message |
    Format-Table -Wrap

Event Identifier Categories:

The EventIdentifier property categorises the exact nature of the recorded occurrence:

• 1: Application Failure (software crash or unexpected termination)
• 2: Application Hang (application stopped responding)
• 3: Windows Failure (operating system crash / Blue Screen of Death)
• 4: Miscellaneous Failure (unexpected system shutdown / power loss)
• 10: Successful Software Installation or Windows Update

---

Step 3: Filter Exclusively for Application and System Crashes

To eliminate informational software install notices and focus strictly on critical errors and software crashes:

Get-CimInstance -ClassName Win32_ReliabilityRecords |
    Where-Object { $_.EventIdentifier -in @(1, 2, 3, 4) } |
    Select-Object TimeGenerated, SourceName, Message |
    Format-Table -AutoSize

This targeted query instantly exposes the offending process name (e.g., explorer.exe, teams.exe), faulting module, and crash timestamps.

---

Step 4: Query the Current System Stability Index Score

Windows tracks the overall health curve of your computer through the Win32_ReliabilityStabilityMetrics class. The System Stability Index score ranges between 1.0 (frequent crashes) and 10.0 (rock solid):

Get-CimInstance -ClassName Win32_ReliabilityStabilityMetrics |
    Select-Object -First 10 TimeGenerated, SystemStabilityIndex |
    Format-Table -AutoSize

To calculate your average stability index score over the past 30 days:

(Get-CimInstance -ClassName Win32_ReliabilityStabilityMetrics |
    Measure-Object -Property SystemStabilityIndex -Average).Average

---

Step 5: Export a Comprehensive Reliability Report to CSV

To produce an executive audit report of all system crashes and software changes for diagnostic documentation:

$ReportPath = "$env:USERPROFILE\Desktop\Reliability_Audit_Report.csv"

Get-CimInstance -ClassName Win32_ReliabilityRecords |
    Select-Object TimeGenerated, EventIdentifier, SourceName, Message, ComputerName |
    Export-Csv -Path $ReportPath -NoTypeInformation -Encoding utf8

Write-Host "Reliability report exported successfully to: $ReportPath" -ForegroundColor Green

---

Troubleshooting Common Reliability Query Issues

Win32_ReliabilityRecords Returns No Data

If querying Win32_ReliabilityRecords outputs nothing, the background RAC (Reliability Analysis Component) scheduled task may be disabled or Windows may have been freshly installed within the last 24 hours. Verify that the task is enabled and run it manually:

Get-ScheduledTask -TaskName "RacTask" | Enable-ScheduledTask
Start-ScheduledTask -TaskName "RacTask"

System Stability Index Shows 0 or Blank

A score of zero indicates that the operating system has not yet accumulated sufficient uptime data to calculate rolling metrics (typically requiring at least 24 to 48 hours of baseline operation following a clean installation or major feature update).

---

Frequently Asked Questions

What is the difference between Event Viewer and Reliability Monitor?

Event Viewer is a low-level, comprehensive logging engine that stores every informational, warning, and error packet generated across the OS. The Reliability Monitor is a curated analytical abstraction layer that filters out noise to focus exclusively on events that directly impact user-perceived system stability.

Can I clear the Windows Reliability History?

While there is no native GUI button to reset the graph, administrators can purge historical reliability records by stopping the RAC service and deleting the binary state files located in C:\ProgramData\Microsoft\RAC\PublishedData and C:\ProgramData\Microsoft\RAC\StateData.

Does running reliability queries impact gaming or workstation performance?

No. Querying Win32_ReliabilityRecords reads static pre-compiled records from the WMI repository. The operation executes in a fraction of a second and produces no measurable load on CPU or disk performance.