Windows Ereignisprotokoll - Sicherheit auslesen

On Error Resume Next
Const wbemFlagReturnImmediately = &h10
Const wbemFlagForwardOnly = &h20
arrComputers = Array("localhost")
For Each strComputer In arrComputers
  WScript.Echo "=============================================================="
  WScript.Echo "Computer. . . . . . . . . . . : " & strComputer
  WScript.Echo "=============================================================="
  Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
  Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_NTEventlogFile", _
  "WQL", wbemFlagReturnImmediately + wbemFlagForwardOnly)

  For Each objItem In colItems
    WScript.Echo "AccessMask. . . . . . . . . . : " & objItem.AccessMask
    WScript.Echo "Archive . . . . . . . . . . . : " & objItem.Archive
    WScript.Echo "Caption . . . . . . . . . . . : " & objItem.Caption
    WScript.Echo "Compressed. . . . . . . . . . : " & objItem.Compressed
    WScript.Echo "CompressionMethod . . . . . . : " & objItem.CompressionMethod
    WScript.Echo "CreationClassName . . . . . . : " & objItem.CreationClassName
    WScript.Echo "CreationDate. . . . . . . . . : " & WMIDateStringToDate(objItem.CreationDate)
    WScript.Echo "CSCreationClassName . . . . . : " & objItem.CSCreationClassName
    WScript.Echo "CSName. . . . . . . . . . . . : " & objItem.CSName
    WScript.Echo "Description . . . . . . . . . : " & objItem.Description
    WScript.Echo "Drive . . . . . . . . . . . . : " & objItem.Drive
    WScript.Echo "EightDotThreeFileName . . . . : " & objItem.EightDotThreeFileName
    WScript.Echo "Encrypted . . . . . . . . . . : " & objItem.Encrypted
    WScript.Echo "EncryptionMethod. . . . . . . : " & objItem.EncryptionMethod
    WScript.Echo "Extension . . . . . . . . . . : " & objItem.Extension
    WScript.Echo "FileName. . . . . . . . . . . : " & objItem.FileName
    WScript.Echo "FileSize. . . . . . . . . . . : " & objItem.FileSize
    WScript.Echo "FileType. . . . . . . . . . . : " & objItem.FileType
    WScript.Echo "FSCreationClassName . . . . . : " & objItem.FSCreationClassName
    WScript.Echo "FSName. . . . . . . . . . . . : " & objItem.FSName
    WScript.Echo "Hidden. . . . . . . . . . . . : " & objItem.Hidden
    WScript.Echo "InstallDate . . . . . . . . . : " & WMIDateStringToDate(objItem.InstallDate)
    WScript.Echo "InUseCount. . . . . . . . . . : " & objItem.InUseCount
    WScript.Echo "LastAccessed. . . . . . . . . : " & WMIDateStringToDate(objItem.LastAccessed)
    WScript.Echo "LastModified. . . . . . . . . : " & WMIDateStringToDate(objItem.LastModified)
    WScript.Echo "LogfileName . . . . . . . . . : " & objItem.LogfileName
    WScript.Echo "Manufacturer. . . . . . . . . : " & objItem.Manufacturer
    WScript.Echo "MaxFileSize . . . . . . . . . : " & objItem.MaxFileSize
    WScript.Echo "Name. . . . . . . . . . . . . : " & objItem.Name
    WScript.Echo "NumberOfRecords . . . . . . . : " & objItem.NumberOfRecords
    WScript.Echo "OverwriteOutDated . . . . . . : " & objItem.OverwriteOutDated
    WScript.Echo "OverWritePolicy . . . . . . . : " & objItem.OverWritePolicy
    WScript.Echo "Path. . . . . . . . . . . . . : " & objItem.Path
    WScript.Echo "Readable. . . . . . . . . . . : " & objItem.Readable
    strSources = Join(objItem.Sources, ",")
    WScript.Echo "Sources . . . . . . . . . . . : " & strSources
    WScript.Echo "Status. . . . . . . . . . . . : " & objItem.Status
    WScript.Echo "System. . . . . . . . . . . . : " & objItem.System
    WScript.Echo "Version . . . . . . . . . . . : " & objItem.Version
    WScript.Echo "Writeable . . . . . . . . . . : " & objItem.Writeable
    WScript.Echo "--------------------------------------------------------------"
  Next
Next

Function WMIDateStringToDate(dtmDate)
  WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & _
  Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) _
  & " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2))
End Function