sDate = Date ' for specific date use CDate("April 24, 2009")
sTargetEXE = "setup.exe" 'you can also use full or partial path
Const cISIdx = 2
Set dDate0 = CreateObject("WbemScripting.SWbemDateTime")
Set dDate1 = CreateObject("WbemScripting.SWbemDateTime")
Set dDateL = CreateObject("WbemScripting.SWbemDateTime")
dDate0.SetVarDate sDate, True
dDate1.SetVarDate sDate + 1, True
Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate,(Security)}!\\.\root\cimv2")
Set cEvts = oWMI.ExecQuery("Select * FROM Win32_NTLogEvent WHERE Logfile = 'Security' AND EventIdentifier = 560 AND TimeWritten >= '" & dDate0 & "' AND TimeWritten < '" & dDate1 & "'")
WScript.Echo "Date,Time,Program,User"
For Each oEvt in cEvts
If Not isNull(oEvt.InsertionStrings) Then
If InStr(oEvt.InsertionStrings(cISIdx), sTargetEXE) > 0 Then
dDateL.Value = oEvt.TimeWritten
dDateLog = dDateL.GetVarDate(True)
Wscript.Echo Month(dDateLog) & "/" & Day(dDateLog) & "/" & Year(dDateLog) & "," & Hour(dDateLog) & ":" & Right("0" & Minute(dDateLog),2) & "." & Right("0" & Second(dDateLog),2) & "," & oEvt.InsertionStrings(cISIdx) & "," & oEvt.User
End If
End If
Next
|