I am using dumpel.exe to dump several domain controllers' security
event logs 3 times per day. We generate numerous large .evt files due
to required corporate auditing mandates. Now I need to write a
vbscript that will allow me to parse multiple .evt files, looking for
any user activity for a specified user across several days, for
example. I have the need to put this into a fully automated script,
for various reasons, which as far as I can tell rules out eventcomb,
as it appears to require the GUI interface to run interactively. Does
anyone have any suggestion on how to parse these .evt files? I
haven't yet found any utilities other than eventcomb that allow me to
even search a flat .evt file. If you have suggestions, or think
dumpel or eventcomb may still work, please provide an example of the
syntax of these could work given my scenario. Thanks!