Read the Reliability Monitor to Date a Problem

**perfmon /rel** opens Reliability Monitor directly. The graph shows the stability index per day; a drop is a day with failures, not a hardware reading.

perfmon /rel

Click the day and read the report below: application failures, Windows failures, warnings, and then information events such as installs and updates. The install list is the part people skip.

:: click the lowest point on the graph, then expand 'Information'

**Win32_ReliabilityRecords** holds the entries behind the graph. Filtering by source turns a month of noise into the three rows you actually need.

Get-CimInstance Win32_ReliabilityRecords -ErrorAction SilentlyContinue |
  Where-Object { $_.EventIdentifier -in 1000,1001,17,19,20,41 } |
  Sort-Object TimeGenerated -Descending |
  Select-Object -First 15 TimeGenerated,SourceName,EventIdentifier,ProductName

Updates, driver packages and application installs are recorded next to the failures. A crash that starts the day of a driver update is not a mystery.

Get-CimInstance Win32_ReliabilityRecords |
  Where-Object SourceName -match 'Install|Update|Setup' |
  Sort-Object TimeGenerated -Descending | Select-Object -First 10 TimeGenerated,SourceName,ProductName
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

The numeric metric is what the graph draws. A slow slide over weeks looks different from a single cliff, and the two point at different causes.

Get-CimInstance Win32_ReliabilityStabilityMetrics |
  Sort-Object TimeGenerated -Descending |
  Select-Object -First 10 TimeGenerated,SystemStabilityIndex

Remove or update the suspect, then check whether new failures appear after the change date. Reliability Monitor keeps roughly a month, so decide within that window.

Get-CimInstance Win32_ReliabilityRecords |
  Where-Object { $_.TimeGenerated -gt (Get-Date).AddDays(-7) -and $_.EventIdentifier -in 1000,1001,41 } |
  Measure-Object | Select-Object Count