View Single Post
  #1 (permalink)  
Old September 29th, 2004, 09:09 AM
Ronb722 Ronb722 is offline
Registered User
 
Join Date: Sep 2004
Posts: 2
Thanks: 0
Thanked 0 Times in 0 Posts
Default Checking Security Event log for failed logins

Hi all,
I'm trying to write a VBScript that will check the Security Event Log in the Event Viewer for fail logins (EventID - 529). I've written a VBScript that will show events in the system log but I can't seem to get the script to find events in the security log. Any ideas?

Thanks,
Ron

strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'System' and " _
& "EventCode = '6008'")

Set colSecLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'Security' and " _
& "EventCode = '529'")

Wscript.Echo "Unexpected shutdowns: " & colLoggedEvents.Count & _
"Failed logins: " & colSecLoggedEvents.Count
Reply With Quote