PS C:\Users\Administrator> $DiskFailures = Get-WinEvent -LogName System -FilterXPath "*[System[EventID=142 or EventID=157]]" | Sort-Object TimeCreated -Descending
PS C:\Users\Administrator> if ($shutdownFailures) {
>>     Write-Output "Disk Failures:"
>>     $DiskFailures | Select-Object TimeCreated, Id, Message
>> } else {
>>     Write-Output "No disk failures found."
>> }
Disk Failures:

TimeCreated            Id Message
-----------            -- -------
11/4/2025 10:05:31 AM 157 Disk 3 has been surprise removed.
11/4/2025 9:54:04 AM  142 Extent Disk2-01 on disk {0d0e1c41-adfb-11f0-ae50-b83fd2329ac9} that is part of the fault-tolerant volume G: is no longer accessible.
11/4/2025 9:54:04 AM  157 Disk 6 has been surprise removed.

