|
Subject:
|
Checking Security Event log for failed logins
|
|
Posted By:
|
Ronb722
|
Post Date:
|
9/29/2004 9:09:50 AM
|
Hi all,
I'm trying to write a VBScript that will check the Security Event Log in the Event Viewer for fail logins (EventID - 529). I've written a VBScript that will show events in the system log but I can't seem to get the script to find events in the security log. Any ideas?
Thanks,
Ron
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'System' and " _
& "EventCode = '6008'")
Set colSecLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'Security' and " _
& "EventCode = '529'")
Wscript.Echo "Unexpected shutdowns: " & colLoggedEvents.Count & _
"Failed logins: " & colSecLoggedEvents.Count
|
|
Reply By:
|
pgtips
|
Reply Date:
|
9/29/2004 10:01:31 AM
|
It's a privileges issue. Change your GetObject call to include this part:
{impersonationLevel=impersonate,(Security)}
The ",(Security)" bit on the end makes all the difference.
|
|
Reply By:
|
happygv
|
Reply Date:
|
9/29/2004 10:04:46 AM
|
You might want to take a look at this.
WMI and Event Logs
Hope that helps.
Cheers!
_________________________
- Vijay G
Strive for Perfection
|
