Event ID Searching in Security logs

[jerphillips]

Hey guys I aquired this script from the internet that is suppose to go through the event logs looking for a certain event ID. I can get this script to run in Windows 2003 but not in Windows 2000. I don't receive any errors when it runs but I also don't get any information in the CSV file. Any help will be appreciated.

Thanks

Const ForAppending = 8
Set fso = CreateObject("Scripting.FileSystemObject")
If fso.FileExists("EventGrabber.csv") Then
fso.DeleteFile("EventGrabber.csv")
end if
Set LogFile = fspenTextFile ("EventGrabber.csv", 2, True)
Set ServerList = fspenTextFile ("ServerList.txt", 1)

LogFile.Writeline "Category," _
& "Computer Name," _
& "Event Code," _
& "Record Number," _
& "Source Name," _
& "Time Written," _
& "Event Type,"_
& "User," _
& "Message"


Do Until ServerList.AtEndOfStream

strComputer = ServerList.Readline
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" _
& strComputer & "\root\cimv2")

Set colLoggedEvents = objWMIService.ExecQuery _
("SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'Security' AND " _
& "EventCode = '528'")

For Each objEvent in colLoggedEvents
LogFile.Writeline objEvent.Category _
& "," & objEvent.ComputerName _
& "," & objEvent.EventCode _
& "," & objEvent.RecordNumber _
& "," & objEvent.SourceName _
& "," & objEvent.TimeWritten _
& "," & objEvent.Type _
& "," & objEvent.User _
& "," & replace(objEvent.Message,vbcrlf," ")
Next
Loop

Wscript.Echo "Event Grabber Finished:"
LogFile.close
ServerList.close

 

[tsuji]

Hello jerphillips,

This is an instance where semi-synchronous mode can make material difference in speed. As you did not get runtime error with your win2k box, you should try this and grant the script some time to get done.

Set colLoggedEvents = objWMIService.ExecQuery _
        ("SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'Security' AND " _
            & "EventCode = '528'",,48)

regards - tsuji

 

[jerphillips]

Actually I just won the bone head award for this one. The Event ID I was looking for is for Logging onto the Server and what I needed it for was File access. Thanks for the help