Hi all,
I'm trying to write a VBScript that will check the Security Event Log in the Event Viewer for fail logins (EventID - 529). I've written a VBScript that will show events in the system log but I can't seem to get the script to find events in the security log. Any ideas?

Thanks,
Ron

strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'System' and " _
& "EventCode = '6008'")

Set colSecLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'Security' and " _
& "EventCode = '529'")

Wscript.Echo "Unexpected shutdowns: " & colLoggedEvents.Count & _
"Failed logins: " & colSecLoggedEvents.Count

It's a privileges issue. Change your GetObject call to include this part:
{impersonationLevel=impersonate,(Security)}

The ",(Security)" bit on the end makes all the difference.

You might want to take a look at this.

WMI and Event Logs

Hope that helps.
Cheers!

_________________________
- Vijay G
Strive for Perfection