troubleshooting Question

List specific Events from the Security Event Log

Avatar of pzozulka
pzozulka asked on
Visual Basic.NETWindows Server 2003Windows XP
9 Comments1 Solution797 ViewsLast Modified:
Greetings,

I am in charge of a server that needs to collect logon/logoff security logs from various workstations.
I looked into a couple books laying around and found a VBS script. However, the script backs up everything, I need to narrow it down to only a specific user, and only event id = 528 or 551.

The script is below, how can it be modified to be more specific, or are there any other script that can do what I need?
On Error Resume Next
Set EventLog = GetObject("winmgmts:{impersonationlevel=impersonate}").ExecQuery("select * from Win32_NTLogEvent")
 
Set FSO = CreateObject("Scripting.FileSystemObject")
Set txt = FSO.CreateTextFile("C:\Scriptfiles\vbs\text.txt", True)
For each Entry in EventLog
 If Len(Entry.Message) > 0 Then
  For x = 1 to Len(Entry.Message)
   Char = Mid(Entry.Message,x,1)
   If Asc(Char) = 10 Then
    MSG = MSG & " "
   ElseIf Asc(Char) <> 13 Then
    MSG = MSG & Char
   End If
  Next
 EDate = Mid(Entry.TimeGenerated,5,2) & "/" & _
  Mid(Entry.TimeGenerated,7,2) & "/" & _
  Mid(Entry.TimeGenerated,1,4)
 ETime = Mid(Entry.TimeGenerated,9,2) & ":" & _
  Mid(Entry.TimeGenerated,11,2) & ":" & _
  Mid(Entry.TimeGenerated,13,2)
 ETime = FormatDateTime(ETime,3)
 
 If IsNull(Entry.User)  Then
  User = "N/A"
 Else
  User = Entry.User
 End If
 
 If IsNull(Entry.CategoryString) Then
  Category = "none"
 Else
  Category =Entry.CategoryString
 End If
 
 EVT = Entry.LogFile & VBtab & _
 Entry.Type & VBtab & _
 EDate & VBtab & _
 ETime & VBTab & _
 Entry.SourceName & VBtab & _
 Category & VBtab & _
 Entry.EventCode & VBtab & _
 User & VBtab & _
 Entry.ComputerName & VBtab & _
 MSG
 txt.writeline EVT
 
 EVT = Null
 Char = Null
 MSG = Null
End If
Next
txt.close
Wscript.echo "Done"
ASKER CERTIFIED SOLUTION
Member_2_4512246

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Join our community to see this answer!
Unlock 1 Answer and 9 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 9 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros