Afaik these are two different events, capture both.
Something like this.
You'll notice that a GuestOS shutdown generates both types of events.
So ultimately you should only look for the VmPoweredOffEvent
$vms = Get-VM | where{$_.PowerState -eq 'PoweredOff'}
Get-VIEvent -Entity $vms -Start (Get-Date).AddDays(-1) -MaxSamples ([int]::MaxValue) |
where{$_ -is [VMware.Vim.VmGuestShutdownEvent] -or $_ -is [VMware.Vim.VmPoweredOffEvent]} |
Select @{N='Date';E={$_.CreatedTime}},
@{N='VM';E={$_.Vm.Name}},
@{N='User';E={$_.UserName}},
@{N='EventType';E={$_.GetType().Name}}
