var wbemFlagReturnImmediately = 0x10;
var wbemFlagForwardOnly = 0x20;
var objWMIService = GetObject('winmgmts:\\\\.\\root\\CIMV2');
var colItems = objWMIService.ExecQuery("SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'System' AND SourceName='EventLog' AND (EventCode=6006 OR EventCode=6008)"
                                       ,'WQL'
                                       ,wbemFlagReturnImmediately | wbemFlagForwardOnly);
var enumItems = new Enumerator(colItems);
if(!enumItems.atEnd())
{
  var objItem = enumItems.item();
  str = '----------------------------------------------------------------------'
       +'\nEventCode:     ' + objItem.EventCode
       +'\nEventType:     ' + objItem.EventType
       +'\nMessage:       ' + objItem.Message
       +'\nRecordNumber:  ' + objItem.RecordNumber
       +'\nTimeWritten:   ' + objItem.TimeWritten
       +'\nType:          ' + objItem.Type
       +'\n'
  WScript.Echo(str);

  if(objItem.EventCode == '6008') // Message: Предыдущее завершение работы системы в ... на ... было неожиданным.
    WScript.Echo('Bad shutdown');
  else //if(objItem.EventCode == '6006') // Message: Служба журнала событий остановлена
    WScript.Echo('Good shutdown');
}
else
  WScript.Echo('HZ shutdown');