Richard
Thu Mar 16 13:18:58 CST 2006
Hi,
This link (near the bottom) discusses this:
http://www.microsoft.com/technet/scriptcenter/guide/sas_log_iwbi.mspx
It says you need the "Manage auditing and security logs" user right and the
script must include the Security privilege. Nothing special needed for the
other logs.
--
Richard
Microsoft MVP Scripting and ADSI
Hilltop Lab -
http://www.rlmueller.net
"Mario Lavigne" <stinkymario@hotmail.com> wrote in message
news:%23hSk3VSSGHA.336@TK2MSFTNGP12.phx.gbl...
> Nah, the Firewall isn't active.
>
> Just another quick question, if I want to access the eventlog from another
> computer, do I need administrator rights? I want to get the Domain
> Controllers Security Eventlogs and I'd rather not use "Domain Admins" for
> the user that will use the script.
>
> Thanks again!
>
>
> Mario Lavigne
>
> "Richard Mueller" <rlmueller-NOSPAM@ameritech.NOSPAM.net> a écrit dans le
> message de news: %23qNuHqQSGHA.4952@TK2MSFTNGP09.phx.gbl...
>>I would suspect the Windows firewall in XP.
>>
>> Richard
>>
>> "Mario Lavigne" <stinkymario@hotmail.com> wrote in message
>> news:u5Px2MQSGHA.4960@TK2MSFTNGP12.phx.gbl...
>>> Hi,
>>>
>>> Turned out it was my Windows XP. Most of our computers are running
>>> Windows 2000 and I just ran the script on a Windows 2000 and it works.
>>> My Windows XP is still giving the same error message though.
>>>
>>> Thanks!
>>>
>>>
>>> Mario Lavigne
>>>
>>> "Richard Mueller" <rlmueller-NOSPAM@ameritech.NOSPAM.net> a écrit dans
>>> le message de news: uh7Y2aHSGHA.792@TK2MSFTNGP10.phx.gbl...
>>>> Hi,
>>>>
>>>> Your code is fine. In fact it matches exactly listing 12.2 in
>>>> "Microsoft Windows 2000 Scripting Guide". I believe your error is
>>>> raised on the statement "Set objWMIService = GetObject", which I use
>>>> all the time to retrieve info from remote computers. It's as if
>>>> something in your network is blocking WMI traffic. Could it be a
>>>> firewall?
>>>>
>>>> --
>>>> Richard
>>>> Microsoft MVP Scripting and ADSI
>>>> Hilltop Lab -
http://www.rlmueller.net
>>>>
>>>> "Mario Lavigne" <stinkymario@hotmail.com> wrote in message
>>>> news:eznEEMHSGHA.1948@TK2MSFTNGP09.phx.gbl...
>>>>> Hi Richard,
>>>>>
>>>>> I am trying to gather the event logs from a DC and I'm in the Domain
>>>>> Admins group for the purpose of the test. I still have that error
>>>>> event with full Admin rights.
>>>>>
>>>>> Any other ideas?
>>>>>
>>>>> Mario Lavigne
>>>>>
>>>>> "Richard Mueller" <rlmueller-NOSPAM@ameritech.NOSPAM.net> a écrit dans
>>>>> le message de news: uPnVPBFSGHA.3192@TK2MSFTNGP09.phx.gbl...
>>>>>> Mario Lavigne wrote:
>>>>>>
>>>>>>> I am trying to make a script that could read an eventlog from a
>>>>>>> remote comptuer. I found some code on MS website :
>>>>>>>
>>>>>>>
>>>>>>> strComputer = "."
>>>>>>> Set objWMIService = GetObject("winmgmts:" _
>>>>>>> & "{impersonationLevel=impersonate}!\\" _
>>>>>>> & strComputer & "\root\cimv2")
>>>>>>> Set colLogFiles = objWMIService.ExecQuery _
>>>>>>> ("Select * from Win32_NTEventLogFile " _
>>>>>>> & "Where LogFileName='System'")
>>>>>>> For Each objLogFile in colLogFiles
>>>>>>> Wscript.Echo objLogFile.NumberOfRecords
>>>>>>> Next
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> When using "." for strComputer, everything works fine. If I put a
>>>>>>> remote computer, the 800A0046 error appears (Access Denied
>>>>>>> 'GetObject'). I also tried the permission
>>>>>>> "{impersonationLevel=impersonate, (Security)}" with no success.
>>>>>>>
>>>>>>> Any clues?
>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> You need administrative rights on the remote computer. Your user
>>>>>> account, or a group you are a member of (like "Domain Admins") should
>>>>>> be a member of the local Administrators group on the remote machine.
>>>>>> Of course, WMI must be installed and DCOM cannot be disabled (any
>>>>>> computer with Windows 2000 or above should be OK).
>>>>>>
>>>>>> --
>>>>>> Richard
>>>>>> Microsoft MVP Scripting and ADSI
>>>>>> Hilltop Lab -
http://www.rlmueller.net
>>>>>>
>>>>>
>>>>>
>>>>
>>>>
>>>
>>>
>>
>>
>
>