Im using this to qry the security logs by date, and is supported in W2k3
Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")
DateToCheck = DATE -1
dtmStartDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
dtmEndDate.SetVarDate DateToCheck + 1, CONVERT_TO_LOCAL_TIME
But not in W2K, Does anyone have a workaround that will work in both windows
200O & 2003 Server Server, My test code is below.
Regards
Don Grover
'*********************************************************************************
Option Explicit
Dim dtmStartDate, dtmEndDate, DateToCheck, strComputer
Dim objWMIService, colEvents, objEvent, sMessageStringCat, sheader
Dim CONVERT_TO_LOCAL_TIME, sEmailBlurb, iCounter
'Message tagged to the bottom of each email
sEmailBlurb = " " & VbCrLf & String(66,"=") & VbCrLf & "WARNING - This email
and any attachments may be confidential. If received in error, please delete
and inform us by return email." & VbCrLf & VbCrLf &_
"Because emails and attachments may be interfered with, may contain computer
viruses or other defects and may not be successfully replicated on other
systems, you must be cautious." & VbCrLf &_
"CokeShop cannot guarantee that what you receive is what we sent. If you
have any doubts about the authenticity of an email by CokeShop, please
contact us immediately. " & VbCrLf &_
"It is also important to check for viruses and defects before opening or
using attachments. CokeShop's liability is limited to resupplying any
affected attachments." & VbCrLf &_
String(66,"*") & VbCrLf & "CokeShop Online" & VbCrLf & "A.C.N. 106 964 345"
& VbCrLf & "A.B.N. 62 106 964 345" & VbCrLf & String(66,"*") & VbCrLf
'Application Variables
Dim sEmailFrom, sEmailTo, iEmailPort, sConEmailMonitor
sEmailFrom = "xxx@netspace.net.au"
sEmailTo = "xxx@netspace.net.au"
sConEmailMonitor = "xxx@netspace.net.au"
strComputer = "myserver"
iEmailPort = 25
iCounter = 0
sheader = String(55,"_")
CONVERT_TO_LOCAL_TIME = True
Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")
DateToCheck = DATE -1
dtmStartDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
dtmEndDate.SetVarDate DateToCheck + 1, CONVERT_TO_LOCAL_TIME
Dim sMonth, sDay
If Len(Month(Date)) = 1 then sMonth = "0" & Month(Date)
If Len(Day(Date)) = 1 then sDay = "0" & Day(Date)
Wscript.echo dtmStartDate & " " & Year(Date) & sMonth & Day(Date)
Wscript.quit
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" & _
strComputer & "\root\cimv2")
Set colEvents = objWMIService.ExecQuery ("Select * from Win32_NTLogEvent
Where LogFile='Security' AND (TimeWritten >= '" _
& dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "')
AND (EventCode='529') ")
For each objEvent in colEvents
iCounter = iCounter + 1
sMessageStringCat = sMessageStringCat & VbCrLf & sHeader & VbCrLf & vBtAB
& "Category: " & objEvent.Category & vBcRlF & vBtAB & "Computer Name: " &
objEvent.ComputerName & vBcRlF &vBtAB & "Message: " & objEvent.Message
Next
Set colEvents = Nothing
Set objWMIService = Nothing
If iCounter > 0 Then
SendEmailNotification "Email remote login security report from " &
UCASE(strComputer) ,"Sent: " & FormatDateTime(Now) & VbCrLf & _
"This is an automated security report from " &
UCASE(strComputer) & VbCrLf & _
"The below list is all FAILED remote logins to "
& strComputer & "By Windows Terminal Services " & VbCrLf & sMessageStringCat
End If
WScript.Quit
Function SendEmailNotification(TheSubJect, TheBody)
'******************************************************
'*** Send the message Using CDOSYS Win2k & Win2003 ****
'******************************************************
On Error Resume Next
' CDO mail object
Dim sch, cdoConfig, cdoMessage, sError
sch = "http://schemas.microsoft.com/cdo/configuration/"
Set cdoConfig = CreateObject("CDO.Configuration")
cdoConfig.Fields.Item(sch & "sendusing") = 2
cdoConfig.Fields.Item(sch & "smtpserverport") = iEmailPort
cdoConfig.Fields.Item(sch & "smtpserver") = strComputer
cdoConfig.Fields.Update
Set cdoMessage = CreateObject("CDO.Message")
Set cdoMessage.Configuration = cdoConfig
cdoMessage.From = sEmailFrom
cdoMessage.To = sEmailTo
cdoMessage.BCC = sConEmailMonitor
cdoMessage.Subject = TheSubJect
cdoMessage.TextBody = TheBody & sEmailBlurb
'
cdoMessage.item("http://schemas.microsoft.com/cdo/configuration/smtpauthenticate").value
= 1 ' use clear text authenticate
'
cdoMessage.item("http://schemas.microsoft.com/cdo/configuration/sendpassword").value
="mypassword"
'
cdoMessage.item("http://schemas.microsoft.com/cdo/configuration/sendusername").value
="yourusername"
cdoMessage.Fields.Item("urn:schemas:mailheader:X-MSMail-Priority") =
"High"
cdoMessage.Fields.Item("urn:schemas:mailheader:X-Priority") = 2
cdoMessage.Fields.Item("urn:schemas:mailheader:Keywords") = "COKESHOP"
cdoMessage.Fields.Item("urn:schemas:mailheader:Sensitivity") =
"Company-Confidential"
cdoMessage.Fields.Item("urn:schemas:mailheader:X-Message-Flag") = "Do
not Forward"
cdoMessage.Fields.Update
cdoMessage.Send
Set cdoMessage = Nothing
Set cdoConfig = Nothing
If Err.Number <> 0 Then
sError = Err.Description
End If
On Error Goto 0
End Function