Remote Event Viewer Export

[TheLad]

Guys

I am using the script below which I obtained from

http://msdn.microsoft.com/en-us/library/aa394593(VS.85).aspx

and it works fine for exporting the Event Log on the local server you run the script on but if you change strComputer to a remote server it doesn't work?

strComputer = "REMOTESERVER"
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate,(Backup)}!\\" & _
        strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTEventLogFile " _
        & "Where LogFileName='Application'")
For Each objLogfile in colLogFiles
    errBackupLog = objLogFile.BackupEventLog( _
        "c:\scripts\application.evt")
    WScript.Echo "File saved as c:\scripts\applications.evt"
Next

The server I am running the script from is a domain member server and I am logged in using a Domain Admins account. Is there something I am missing?

TIA

--------------------------------------
"Insert funny comment in here!"
--------------------------------------

 

[mrmovie]

try adjusting the (Backup) part of the "impersonate,(Backup)}!" string

 

[TheLad]

Please can you suggest what to change it to as I have tried adding in Security and also replacing Backup with Security to no avail.

Thanks

--------------------------------------
"Insert funny comment in here!"
--------------------------------------

 

[TheLad]

For archiving purposes, I have resolved this. It turns out that if you specify a remote servername, the destination location needs to exist on the remote server as that is where the Event Viewer is exported to.

So to clarify, I am running the script from SERVER1 and if I specify strComputer as SERVER2 and the errBackupLog as "c:\scripts\application.evt", the c:\scripts location needs to exist on SERVER2 as the Event Viewer will be exported to here rather than SERVER1 where I am running the script from

Hope that makes sense...

--------------------------------------
"Insert funny comment in here!"
--------------------------------------