asked on
procedure GetLogEvents3;
const
wbemFlagForwardOnly = $00000020;
var
FSWbemLocator : OLEVariant;
FWMIService : OLEVariant;
FWbemObjectSet: OLEVariant;
FWbemObject : OLEVariant;
oEnum : IEnumvariant;
iValue : LongWord;
begin
FSWbemLocator := CreateOleObject('WbemScripting.SWbemLocator');
FWMIService := FSWbemLocator.ConnectServer('localhost', 'root\CIMV2', '', '');
FWMIService.Security_.ImpersonationLevel:=3; //Impersonate security
FWbemObjectSet:= FWMIService.ExecQuery('SELECT EventrecordID FROM Win32_NTEventlogFile Where LogFileName="Security"','WQL',wbemFlagForwardOnly);
oEnum := IUnknown(FWbemObjectSet._NewEnum) as IEnumVariant;
while oEnum.Next(1, FWbemObject, iValue) = 0 do
begin
Form1.LogWin.Lines.add(Format('Rec id %s',[Integer(FWbemObject.EventrecordID)]));
Form1.LogWin.Lines.add(Format('Address %s',[Integer(FWbemObject.IpAddress)]));
end;
FWbemObject:=Unassigned;
end;