Home

Google
 

Vbscript to Search Windows Event Logs


‘ —— SCRIPT CONFIGURATION ——
On Error Resume Next

intEventCode = 4377 ‘ Enter the Event ID here
intEventTime = InputBox(”Enter Date in the Format MM/DD/YYYY”, “Enter Date to check Event”) ‘ No default date used
strLog = “System” ‘ Event log name; e.g. Application
intMaxNum = 0 ‘ Max events to return (0 for all)
strSource = “NTServicePack” ‘Enter the Event source here

‘The function of this section is to get the computer name(s) from a text file and connect to computer
Set oFSO = CreateObject(”Scripting.FileSystemObject”)

Set oTS = oFSO.OpenTextFile(”c:\Computer.txt”)

Do Until oTS.AtEndOfStream

varComputer = oTS.ReadLine

arrComputers = Array(varComputer)

‘ —— END CONFIGURATION ———
for each strComputer in arrComputers
WScript.Echo vbCrLf & vbCrLf
WScript.Echo “Searching ” & strComputer & “….” & vbCrLf
set objWMI = GetObject(”winmgmts:\\” & strComputer & “\root\cimv2″)
set colEvents = objWMI.ExecQuery(”Select * from Win32_NTLogEvent ” & _
” Where Logfile = ‘” & strLog & “‘” & _
” and TimeGenerated >= ‘”& intEventTime & “‘” & _
” and SourceName = ‘” &strSource & “‘” & _
” and EventCode = ” & intEventCode)

count = 0
for each objEvent in colEvents
Wscript.Echo “Date: ” & objEvent.TimeWritten
Wscript.Echo “Source: ” & objEvent.SourceName
Wscript.Echo “Category: ” & objEvent.Category
Wscript.Echo “Type: ” & objEvent.Type
Wscript.Echo “Event Code: ” & objEvent.EventCode
Wscript.Echo “User: ” & objEvent.User
Wscript.Echo “Computer: ” & objEvent.ComputerName
Wscript.Echo “Message: ” & objEvent.Message
WScript.Echo “——”
WScript.Echo
count = count + 1
if intMaxNum > 0 and count >= intMaxNum then
WScript.Echo “Reached maximum threshold…exiting”
exit for
end if
next
Next
Loop

The ATTRIB Commnd - CMD


Attrib commnd - Changes file attributes for a single file or directory. This command sets or removes the read-only, system, hidden, and compressed attributes assigned to files or directories.

The attrib commnd with the parameters listed below is only available when you are using the Recovery Console. The attrib command with different parameters is available from the command prompt.

attrib [+r|-r] [+s|-s] [+h|-h] [+c|-c] [[drive:][path] filename]

Parameters

+r

Sets the read-only file attribute.

-r

Clears the read-only file attribute.

+s

Sets the system file attribute.

-s

Clears the system file attribute.

+h

Sets the hidden file attribute.

-h

Clears the hidden file attribute.

+c

Sets the compressed file attribute.

-c

Clears the compressed file attribute.

[[drive:][path] filename]

Specifies the location and name of the directory or file you want to process. You can change attributes for only one file or directory at a time.

AT CMD Commnd


AT - Schedules commands and programs to run on a computer at a specified time and date. You can use at only when the Schedule service is running. Used without parameters, at lists scheduled commands.

Syntax
at [\\ComputerName] [{[ID] [/delete] | /delete [/yes]}]

at [[\\ComputerName] Hours:Minutes [/interactive] [{/every:Date[,…] | /next:Date[,…]}] Command]

Parameters

\\ComputerName
Specifies a remote computer. If you omit this parameter, at schedules the commands and programs on the local computer.
ID
Specifies the identification number assigned to a scheduled command.
/delete
Cancels a scheduled command. If you omit ID, all of the scheduled commands on the computer are canceled.
/yes
Answers yes to all queries from the system when you delete scheduled events.
Hours:Minutes
Specifies the time when you want to run the command. Time is expressed as Hours:Minutes in 24-hour notation (that is, 00:00 [midnight] through 23:59).
/interactive
Allows Command to interact with the desktop of the user who is logged on at the time Command runs.
/every:
Runs Command on every specified day or days of the week or month (for example, every Thursday, or the third day of every month).
Date
Specifies the date when you want to run the command. You can specify one or more days of the week (that is, type M,T,W,Th,F,S,Su) or one or more days of the month (that is, type 1 through 31). Separate multiple date entries with commas. If you omit Date, at uses the current day of the month.
/next:
Runs Command on the next occurrence of the day (for example, next Thursday).
Command
Specifies the Windows command, program (that is, .exe or .com file), or batch program (that is, .bat or .cmd file) that you want to run. When the command requires a path as an argument, use the absolute path (that is, the entire path beginning with the drive letter). If the command is on a remote computer, specify Universal Naming Convention (UNC) notation for the server and share name, rather than a remote drive letter.
/?
Displays help at the command prompt.
Remarks
Schtasks is another command-line scheduling tool that you can use to create and manage scheduled tasks. For more information about schtasks, see Related Topics.

Using at
To use at, you must be a member of the local Administrators group.

Loading Cmd.exe
At does not automatically load Cmd.exe, the command interpreter, before running commands. If you are not running an executable (.exe) file, you must explicitly load Cmd.exe at the beginning of the command as follows:

cmd /c dir > c:\test.out

Viewing scheduled commands
When you use at without command-line options, scheduled tasks appear in a table formatted similar to the following:

Status ID Day Time Command Line
OK 1 Each F 4:30 PM net send group leads status due
OK 2 Each M 12:00 AM chkstor > check.file
OK 3 Each F 11:59 PM backup2.bat

Including identification number (ID)
When you include identification number (ID) with at at a command prompt, information for a single entry appears in a format similar to the following:

Task ID: 1

Status: OK

Schedule: Each F

Time of Day: 4:30 PM

Command: net send group leads status due
After you schedule a command with at, especially a command that has command-line options, check that the command syntax is correct by typing at without command-line options. If the information in the Command Line column is incorrect, delete the command and retype it. If it is still incorrect, retype the command with fewer command-line options.

Viewing results
Commands scheduled with at run as background processes. Output is not displayed on the computer screen. To redirect output to a file, use the redirection symbol (>). If you redirect output to a file, you need to use the escape symbol (^) before the redirection symbol, whether you are using at at the command line or in a batch file. For example, to redirect output to Output.text, type:

at 14:45 c:\test.bat ^>c:\output.txt

The current directory for the executing command is the systemroot folder.

Changing system time
If you change the system time at a computer after you schedule a command to run with at, synchronize the at scheduler with the revised system time by typing at without command-line options.

Storing commands
Scheduled commands are stored in the registry. As a result, you do not lose scheduled tasks if you restart the Schedule service.

Connecting to network drives
Do not use a redirected drive for scheduled jobs that access the network. The Schedule service might not be able to access the redirected drive, or the redirected drive might not be present if a different user is logged on at the time the scheduled task runs. Instead, use UNC paths for scheduled jobs. For example:

at 1:00pm my_backup \\server\share

Do not use the following syntax, where x: is a connection made by the user:

at 1:00pm my_backup x:

If you schedule an at command that uses a drive letter to connect to a shared directory, include an at command to disconnect the drive when you are finished using the drive. If the drive is not disconnected, the assigned drive letter is not available at the command prompt.

Tasks stopping after 72 hours
By default, tasks scheduled using the at command stop after 72 hours. You can modify the registry to change this default value.

Start Registry Editor (regedit.exe).
Locate and click the following key in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule
On the Edit menu, click Add Value, and then add the following registry value: Value Name: AtTaskMaxHours Data type: REG_DWORD Radix: Decimal Value Data: 0. A value of 0 in the value data field indicates no limit, does not stop. Values from 1 through 99 indicates the number of hours.
Caution

Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.
Task Scheduler and the at command
You can use the Scheduled Tasks folder to view or modify the settings of a task that was created by using the at command. When you schedule a task using the at command, the task is listed in the Scheduled Tasks folder, with a name such as the following:At3478. However, if you modify an at task through the Scheduled Tasks folder, it is upgraded to a normal scheduled task. The task is no longer visible to the at command, and the at account setting no longer applies to it. You must explicitly enter a user account and password for the task.

Examples
To display a list of commands scheduled on the Marketing server, type:

at \\marketing
To learn more about a command with the identification number 3 on the Corp server, type:

at \\corp 3
To schedule a net share command to run on the Corp server at 8:00 A.M. and redirect the listing to the Maintenance server, in the Reports shared directory, and the Corp.txt file, type:

at \\corp 08:00 cmd /c “net share reports=d:\marketing\reports >> \\maintenance\reports\corp.txt”
To back up the hard drive of the Marketing server to a tape drive at midnight every five days, create a batch program called Archive.cmd, which contains the backup commands, and then schedule the batch program to run, type:

at \\marketing 00:00 /every:5,10,15,20,25,30 archive
To cancel all commands scheduled on the current server, clear the at schedule information as follows:

at /delete
To run a command that is not an executable (that is, .exe) file, precede the command with cmd /c to load Cmd.exe as follows:

cmd /c dir > c:\test.out

CMD Commnds - Commands


CMD, or CMD.EXE, is the command line shell introduced in Windows NT and available in all the below versions of Microsoft Windows.

Windows NT

Windows XP

Windows 2000

Windows 2003

Here are the commnds useable in CMD interpreter:

ASSOC Displays or modifies file extension associations.
AT Schedules commands and programs to run on a computer.
ATTRIB Displays or changes file attributes.
BREAK Sets or clears extended CTRL+C checking.
CACLS Displays or modifies access control lists (ACLs) of files.
CALL Calls one batch program from another.
CD Displays the name of or changes the current directory.
CHCP Displays or sets the active code page number.
CHDIR Displays the name of or changes the current directory.
CHKDSK Checks a disk and displays a status report.
CHKNTFS Displays or modifies the checking of disk at boot time.
CLS Clears the screen.
CMD Starts a new instance of the Windows command interpreter.
COLOR Sets the default console foreground and background colors.
COMP Compares the contents of two files or sets of files.
COMPACT Displays or alters the compression of files on NTFS partitions.
CONVERT Converts FAT volumes to NTFS. You cannot convert the
current drive.
COPY Copies one or more files to another location.
DATE Displays or sets the date.
DEL Deletes one or more files.
DIR Displays a list of files and subdirectories in a directory.
DISKCOMP Compares the contents of two floppy disks.
DISKCOPY Copies the contents of one floppy disk to another.
DOSKEY Edits command lines, recalls Windows commands, and creates macros.
ECHO Displays messages, or turns command echoing on or off.
ENDLOCAL Ends localization of environment changes in a batch file.
ERASE Deletes one or more files.
EXIT Quits the CMD.EXE program (command interpreter).
FC Compares two files or sets of files, and displays the differences
between them.
FIND Searches for a text string in a file or files.
FINDSTR Searches for strings in files.
FOR Runs a specified command for each file in a set of files.
FORMAT Formats a disk for use with Windows.
FTYPE Displays or modifies file types used in file extension associations.
GOTO Directs the Windows command interpreter to a labeled line in a
batch program.
GRAFTABL Enables Windows to display an extended character set in graphics
mode.
HELP Provides Help information for Windows commands.
IF Performs conditional processing in batch programs.
LABEL Creates, changes, or deletes the volume label of a disk.
MD Creates a directory.
MKDIR Creates a directory.
MODE Configures a system device.
MORE Displays output one screen at a time.
MOVE Moves one or more files from one directory to another directory.
PATH Displays or sets a search path for executable files.
PAUSE Suspends processing of a batch file and displays a message.
POPD Restores the previous value of the current directory saved by PUSHD.
PRINT Prints a text file.
PROMPT Changes the Windows command prompt.
PUSHD Saves the current directory then changes it.
RD Removes a directory.
RECOVER Recovers readable information from a bad or defective disk.
REM Records comments (remarks) in batch files or CONFIG.SYS.
REN Renames a file or files.
RENAME Renames a file or files.
REPLACE Replaces files.
RMDIR Removes a directory.
SET Displays, sets, or removes Windows environment variables.
SETLOCAL Begins localization of environment changes in a batch file.
SHIFT Shifts the position of replaceable parameters in batch files.
SORT Sorts input.
START Starts a separate window to run a specified program or command.
SUBST Associates a path with a drive letter.
TIME Displays or sets the system time.
TITLE Sets the window title for a CMD.EXE session.
TREE Graphically displays the directory structure of a drive or path.
TYPE Displays the contents of a text file.
VER Displays the Windows version.
VERIFY Tells Windows whether to verify that your files are written
correctly to a disk.
VOL Displays a disk volume label and serial number.
XCOPY Copies files and directory trees.


powered by FreeFind