WMI; BackupEventlog(); Access Denied

Forums

My Profile

Inbox

Address Book

My Subscription

My Forums

WMI; BackupEventlog(); Access Denied

Logged in as: Guest

arrSession:exec spGetSession 2,2,64137

	Active Users: There are 0 members and 0 guests.
	Users viewing this topic: none

Printable Version

All Forums >> [Scripting] >> WSH & Client Side VBScript >> WMI; BackupEventlog(); Access Denied
Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks!

Page: [1]

Message

<< Older Topic Newer Topic >>

WMI; BackupEventlog(); Access Denied - 9/9/2008 2:08:50 AM

EpoXain

Posts: 4
Score: 0
Joined: 9/8/2008
Status: offline

Hello Forum-Users,

I have really complex Problem and i am hopefull you can help me.

My VB-Script should save the eventlogs from a remote mashine onto a network storage presented as a share. The share is on a NAS and the permission on the share is "Full Control" for "Everyone".

For backing up the eventlogs i use the BackupEventlog-function from the WMI-service.

I start the script on a mashine local with the rights of an administrator. For the local mashine the script works great.
- logs the progress in a textfile on the same share
- gets connection to the eventlog
- gets the correct size of it
- backing it up on a network share
- clears the eventlog

Also i log the progress in a from me created textfile which is on the same share too.

Now i start the script again on a remote mashine.
- logs the progress in a textfile on the same share
- gets connection to the eventlog
- gets the correct size of it
- trying to back it up
...
And now i get the ERROR_CODE 5, when the function BackupEventlog tries to back it up on the network storage. This code means "Access Denied".
When i back it up on the local remote mashine it works also fine.

Have anyone an idea with which right the funktion "BackupEventlog" from the WMI-Service uses, when it tries to write on the network share? Or whats the matter with it?

strLogName = "Security"

' get connection to eventlog
If strLogName = "Security" Then
set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate, (Backup, Security)}!\\" & strComputer & "\root\cimv2")
Else
set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate, (Backup)}!\\" & strComputer & "\root\cimv2")
End if

' try to open eventlog   
set colLogFiles = objWMIService.ExecQuery("Select * from Win32_NTEventlogFile Where Logfilename = '" & strLogName & "'")
If colLogFiles.Count <> 1 then
strLogText = "Fatal error occured while tried to open " & strLogName & " log. Number of logs found: " & colLogs.Count
objFileLog.WriteLine(strLogText)
objFileLog.WriteLine("#")   
Else
For Each objLogfile in colLogFiles
' log actual size of eventlog
strLogText = strLogName & " log size before cleaning: " & objLogfile.FileSize / 1024 & " KB"
objFileLog.WriteLine(strLogText)
objFileLog.WriteLine("#")
' ensure a leading zero for values smaller ten
strDay = FillPreZero(Day(now))
strMonth = FillPreZero(Month(now))
strHour = FillPreZero(Hour(Now))
strMinute = FillPreZero(Minute(now))

' construct filename    
OutputFilePath = strEventlogBackupPath & strComputer & "\" & strLogName & "\"
OutputFileName = strComputer & "_" & GetLogShort(strLogName)
OutputFileName = OutputFileName & "_" & year(now) & strMonth & strDay & "_" & strHour & strMinute
OutputFileName = OutputFileName & ".evt"

' save eventlog
errBackupLog = objLogFile.BackupEventLog(OutputFilePath & OutputFileName)

' clear eventlog
If errBackupLog = 0 Or errBackupLog = 183 Then
 objLogFile.ClearEventLog()
 strLogText = strLogName & " log have been successfully backed up."
Else
 strLogText = "Error! The " & strLogName & " log could NOT be backed up.                         ERROR_CODE: " & errBackupLog
End If
objFileLog.WriteLine(strLogText)
objFileLog.WriteLine("#")
objFileLog.WriteLine("#")
Next
End If 
Next

strLogText = "########## Archieving process finished (" & Now() & ") ##########"
objFileLog.WriteLine(strLogText)
objFileLog.WriteLine("#")
objFileLog.WriteLine("#")
End If
Loop

' close files and destroy objects
objFileLog.Close
objFileList.Close
Set objFileLog = nothing
Set objFileList = nothing
Set objFSO = nothing 
Set objWMIService = nothing
Set colLogFiles = nothing

< Message edited by EpoXain -- 9/9/2008 2:18:15 AM >

Post #: 1

RE: WMI; BackupEventlog(); Access Denied - 9/9/2008 3:15:37 AM

dm_4ever

Posts: 2670
Score: 46
Joined: 6/29/2006
From: Orange County, California
Status: offline

You might have to change the impersonation level to delegate

_____________________________

dm_4ever

My philosophy: K.I.S.S - Keep It Simple Stupid
Read Me: http://www.visualbasicscript.com/m_24727/tm.htm
Frequently Asked Stuff: http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to EpoXain)

Post #: 2

RE: WMI; BackupEventlog(); Access Denied - 9/9/2008 4:19:05 AM

EpoXain

Posts: 4
Score: 0
Joined: 9/8/2008
Status: offline

I have a Windows 2003 server environment with Windows xp clients, so i can�t use Delegate.

But i�ll use Identify now. Be right back with the score.

(in reply to dm_4ever)

Post #: 3

RE: WMI; BackupEventlog(); Access Denied - 9/9/2008 4:24:19 AM

EpoXain

Posts: 4
Score: 0
Joined: 9/8/2008
Status: offline

When i use delegate, i get an expectet error.

I tried it with Identify and now i get an error while executing the script. Access Denied. It occurs when i try to open an attribut of the object:

1 set colLogFiles = objWMIService.ExecQuery("Select * from Win32_NTEventlogFile Where Logfilename = '" & strLogName & "'")
2 If colLogFiles.Count <> 1 then

The Error points to line 2 first row.

< Message edited by EpoXain -- 9/9/2008 4:26:14 AM >

(in reply to EpoXain)

Post #: 4

RE: WMI; BackupEventlog(); Access Denied - 9/9/2008 5:47:34 AM

EpoXain

Posts: 4
Score: 0
Joined: 9/8/2008
Status: offline

In the MSDN Library is written, that the Delegate-Property is only available in Windows 2k. This means probably FROM Win2k. But i got an errer. The Devil only knows, where it came from.
But now its running. Fully Unproblematic.

Ok, i was ecxited and a little bit hasty

Delegate was the magic word. Thanks for it!

And sorry, if my english is not as well as expected. I�m a german.

< Message edited by EpoXain -- 9/9/2008 5:49:52 AM >

(in reply to EpoXain)

Post #: 5

RE: WMI; BackupEventlog(); Access Denied - 9/9/2008 8:29:24 AM

dm_4ever

Posts: 2670
Score: 46
Joined: 6/29/2006
From: Orange County, California
Status: offline

I'm glad it worked for you.

_____________________________

dm_4ever

My philosophy: K.I.S.S - Keep It Simple Stupid
Read Me: http://www.visualbasicscript.com/m_24727/tm.htm
Frequently Asked Stuff: http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to EpoXain)

Post #: 6

If you found our site useful please link to us <a href="http://www.visualbasicscript.com">VisualBasicScript.com</a>.

All Forums >> [Scripting] >> WSH & Client Side VBScript >> WMI; BackupEventlog(); Access Denied

Page: [1]

Jump to:

New Messages	No New Messages
Hot Topic w/ New Messages	Hot Topic w/o New Messages
Locked w/ New Messages	Locked w/o New Messages

Post New Thread

Reply to Message

Post New Poll

Submit Vote

Delete My Own Post

Delete My Own Thread

Rate Posts