Photo Gallery Member List Search Calendars FAQ Ticket List Log Out


Querying Security event log in Vista

  		Logged in as: Guest
arrSession:exec spGetSession 2,2,61674
Active Users: There are 0 members and 0 guests.
Users viewing this topic: none
 

 

  
 
  Printable Version
All Forums >> [Scripting] >> WSH & Client Side VBScript >> Querying Security event log in Vista
  Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks! 		Page: [1]
Login
Message << Older Topic   Newer Topic >>
Querying Security event log in Vista - 6/20/2008 9:23:01 AM   
  paulmcf

 

Posts: 3
Score: 0
Joined: 6/20/2008
Status: offline 		Hi all,

I'm putting together a WMI script to query the Security event log. Here's the script so far:

compName = "localhost"
Set objWMI = GetObject("winmgmts:{(Security)}!\\" & _
                      compName & "\root\cimv2")
Set colSecLog = objWMI.ExecQuery("SELECT * FROM Win32_NTLogEvent Where " & _
                          "LogFile = 'Security'")
For Each objEvent in colSecLog
   WScript.Echo "Category: " & objEvent.CategoryString & VBCrLf & _
                "Computer: " & objEvent.ComputerName & VBCrLf & _
                "User: " & objEvent.User & VBCrLf & _
                "Event Type: " & objEvent.Type & VBCrLf & _
                "Event Code: " & objEvent.EventCode & VBCrLf & _
                "Source Name: " & objEvent.SourceName & VBCrLf & _
                "Time Written: " & objEvent.TimeWritten & _
                VBCrLf & VBCrLf & _
                "Message: " & VBCrLf & VBCrLf & objEvent.Message
   '
   ' Just Echo one event for now
   '
   Exit For
Next

(To keep things simple, I've taken out a bunch of Where clauses.)

This code works fine in XP, but on Vista machines the query always returns nothing. If I change the LogFile to, say, System, the script works in Vista.

Any idea why Vista always returns nothing when you query the Security log?

Thanks
Paul
 
 
Post #: 1
 
RE: Querying Security event log in Vista - 6/20/2008 1:56:20 PM   
  dm_4ever


Posts: 2665
Score: 46
Joined: 6/29/2006
From: Orange County, California
Status: offline 		This ran fine on my Vista box. What error do you get if any?

_____________________________

dm_4ever

My philosophy: K.I.S.S - Keep It Simple Stupid
Read Me: http://www.visualbasicscript.com/m_24727/tm.htm
Frequently Asked Stuff: http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to paulmcf)
 
 
Post #: 2
 
RE: Querying Security event log in Vista - 6/20/2008 2:35:24 PM   
  paulmcf

 

Posts: 3
Score: 0
Joined: 6/20/2008
Status: offline 		I don't get an error, it just doesn't return any events. For example, Event Viewer shows that I have 25,749 events in the Security log. However, when I run this script, no events are returned ( that is, the WScript.Echo inside the For Each loop never runs).

(in reply to dm_4ever)
 
 
Post #: 3
 
RE: Querying Security event log in Vista - 6/23/2008 1:34:26 AM   
  ebgreen


Posts: 5041
Score: 31
Joined: 7/12/2005
Status: offline 		FOr what it's worth, it works for me on an XP system.

_____________________________

"... when you are good and crazy, oooh, oooh, oooh, the sky is the limit!" - The Tick
Goog places to start:http://www.visualbasicscript.com/m_24727/tm.htm
http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to paulmcf)
 
 
Post #: 4
 
RE: Querying Security event log in Vista - 6/23/2008 1:39:33 AM   
  dm_4ever


Posts: 2665
Score: 46
Joined: 6/29/2006
From: Orange County, California
Status: offline 		I do have that UAC or whatever its called turned off...maybe that could be causing issues for you.

_____________________________

dm_4ever

My philosophy: K.I.S.S - Keep It Simple Stupid
Read Me: http://www.visualbasicscript.com/m_24727/tm.htm
Frequently Asked Stuff: http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to paulmcf)
 
 
Post #: 5
 
RE: Querying Security event log in Vista - 6/23/2008 1:57:50 AM   
  paulmcf

 

Posts: 3
Score: 0
Joined: 6/20/2008
Status: offline 		Okay, I solved it. The script works in Vista if you run it from an elevated Command Prompt (right-click Command Prompt and then click Run As Administrator).

(in reply to dm_4ever)
 
 
Post #: 6
 
 
 
 

If you found our site useful please link to us <a href="http://www.visualbasicscript.com">VisualBasicScript.com</a>.
All Forums >> [Scripting] >> WSH & Client Side VBScript >> Querying Security event log in Vista Page: [1]
Jump to:





New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts




Forum Software © ASPPlayground.NET Advanced Edition 2.5.5 ANSI