Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations Westi on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Reading security log

Status
Not open for further replies.

theniteowl

Programmer
May 24, 2005
1,975
US
Can anyone show me how to alter this code to return just a single record?

Code:
On Error Resume Next

strComputer = "."
Set objWMIService = GetObject("winmgmts:{(Security)}\\" & strComputer & "\root\cimv2")

Set colEvents = objWMIService.ExecQuery _
        ("Select * From Win32_NTLogEvent Where LogFile = 'Security' AND EventCode = '529'")

For Each objEvent in colEvents
    Wscript.Echo "Category: " & objEvent.Category
    Wscript.Echo "Computer Name: " & objEvent.ComputerName
    Wscript.Echo "Event Code: " & objEvent.EventCode
    Wscript.Echo "Message: " & objEvent.Message
    Wscript.Echo "Record Number: " & objEvent.RecordNumber
    Wscript.Echo "Source Name: " & objEvent.SourceName
    Wscript.Echo "Time Written: " & objEvent.TimeWritten
    Wscript.Echo "Event Type: " & objEvent.Type
    Wscript.Echo "User: " & objEvent.User
    Wscript.Echo objEvent.LogFile
Next

I have tried using Select TOP 1 *.... but that always gives me a null value.
This pulls from the local machines security log.
My ultimate goal is to read the most recent connection with eventcode 682 where the session name contains RDP-Tcp.
I have a script that determines if the console session of a server is currently connected to so as to prevent a subsequent connection causing the first person to lose their connect. Now I want to parse the security log to return the computer name of the person connected so I can kick it back to the screen to let me know not only that the session is connected but who has the connection so I can contact them if I have an urgent need to access the server.

At my age I still learn something new every day, but I forget two others.
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top