Hi,

   I have turned on auditing for MSACCESS.EXE so that when Access is opened and closed, a Security Log is generated (592 for open, and 593 for closed.)

   I want to read the log and find out how often and how long Access is used, in this example. The Message part of the log is returned and looks like this:

'=================================
A new process has been created:

    New Process ID: 15744

    Image File Name: C:\Program Files\Microsoft Office\Office10\MSACCESS.EXE

    Creator Process ID: 3704

    User Name: username

    Domain: domainname

    Logon ID: (0x0,XXXXXXXX)
'===========================================

However, when I assign this message to a variable and try to find MSACCESS.EXE in the variable, I get a 0 (string not found).

Here is the code I am using.
'================================================= =========
strComputer = "."

Set objWMIService = GetObject("winmgmts:{impersonationLevel = impersonate, (Security)}!\\" & _
    strComputer & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery("SELECT * FROM Win32_NTLogEvent WHERE LogFile = 'Security'")
For Each objEvent in colLoggedEvents
    If objEvent.EventCode = 592 Or objEvent.EventCode = 593 Then
        strMessage = objEvent.Message
        strApp = "MSACCESS.EXE"
        strYes = InStr(strApp, strMessage)
        If strYes <> 0 Then
            WScript.Echo strMessage
        End If
    End If
Next
'================================================= ===
When I remove the conditonals and just display the messages, everything works fine. When I try to parse the messages, I get nothing.

What am I doing wrong?

Thanks,


mmcdonal

__________________
mmcdonal

Look it up at: http://wrox.books24x7.com