Re: Help with extracting a logon event from Security even log.
From: name (nospam_at_user.com)
Date: 10/09/04
- Next message: name: "Re: vt_array and JScript?"
- Previous message: name: "Re: Updating MIME type in IIS 6.0 via script"
- In reply to: mostro: "Help with extracting a logon event from Security even log."
- Messages sorted by: [ date ] [ thread ]
Date: Sat, 9 Oct 2004 06:03:37 -0400
Probably on your machine only.
----------
Who would be on the top of hierarchy. (Ms aside)
======================
Which machine ?
================
Like buying a machine at CompUsa and
reenter their admin space self freedomized to complain.
--------------------
Not likely.
"mostro" <mostro@adelphia.net> wrote in message
news:u4b54eTrEHA.3848@TK2MSFTNGP14.phx.gbl...
> I would like to extract information about locked accounts from the
Security
> event log. How can I get the user name that locked the account. Below is
the
> Description information from the event. When using objLogFileEvent.User in
> the script NT AUTHORITY\SYSTEM is produced. How do I get the user 'test'
> from the event log?
>
> Logon Failure:
>
> Reason: Account locked out
>
> User Name: test
>
> Domain: MYDOMAIN
>
> Logon Type: 2
>
> Logon Process: User32
>
> Authentication Package: Negotiate
>
> Workstation Name: TEST
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
>
> strComputer = "."
> Set objWMIService = GetObject("winmgmts:" &
> "{impersonationLevel=impersonate, (Security)}!\\" & strComputer &
> "\root\cimv2")
> Set colLoggedEvents = objWMIService.ExecQuery ("SELECT * FROM
> Win32_NTLogEvent WHERE Logfile = 'Security' AND EventCode = '539'")
> For Each objLogFileEvent in colLoggedEvents
> Wscript.Echo objLogFileEvent.ComputerName
> Wscript.Echo objLogFileEvent.User '< produces NT AUTHORITY\SYSTEM not
the
> user.
>
> Next
>
>
> Thank in advance
>
>
>
- Next message: name: "Re: vt_array and JScript?"
- Previous message: name: "Re: Updating MIME type in IIS 6.0 via script"
- In reply to: mostro: "Help with extracting a logon event from Security even log."
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
