VBS WMI Query on Win32_NetworkLoginProfile Class

14 Agustus 2008 16:54

Hi. I apologize if I am posting this in the wrong area, but I have been puzzling over this issue and don't quite know where to go from here. If this is the wrong arena, please direct me to the correct one.

I am using Scriptomatic to query the WMI Class - Win32_NetworkLoginProfile. I am able to query my local computer and other computers on the network. Reviewing the results from the other computers on the network, I am able to garner all sorts of information about all the accounts that have logged onto each computer. However, when I query my local computer, I only get the NT AUTHORITY\SYSTEM, the NT AUTHORITY\LOCAL SERVICE, the NT AUTHORITY\NETWORK SERVICE and the current logged on user information. I do not get the complete information I would if querying it remotely.

I have gone to another computer and verified I can pull all users' info from my original computer. So I know the info is there ... I am just having an issue pulling it from the local computer.

I would like to write a VBS that will run in the local system account and pull info about all users who have logged in and write to a local log file and a network log file. I have the script written, but just can't get all the info I know is there.

Here's the script:

1
Option Explicit   

2
On Error Resume Next  

3
 

4
Const wbemFlagReturnImmediately = &h10  

5
Const wbemFlagForwardOnly = &h20  

6
 

7
' Declare variables  

8
Dim objFSO, objOutputFileLoc, objOutputFileParentLoc, objOutputFileDirLoc, WshNetwork, objWinDirLoc  

9
Dim objOutputFileDirSrv, objOutputFileSrv, objWMIService, strComputerName, strComputer  

10
Dim colNetUser, objNetUser, strName, strLastLogon, strFullName, strComment, strDescription  

11
 

12
' Set variables  

13
strComputer = "." 

14
objWinDirLoc = "C:\Windows" 

15
objOutputFileParentLoc = objWinDirLoc & "\LocDir"  

16
objOutputFileDirLoc = objOutputFileParentLoc & "\LoggedUser\"  

17
objOutputFileDirSrv = "\\ServerName\ShareName\LoggedUser\" 

18
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\CIMV2")  

19
Set objFSO = CreateObject("Scripting.FileSystemObject")  

20
Set WshNetwork = WScript.CreateObject("WScript.Network")  

21
strComputerName = WshNetwork.ComputerName  

22
 

23
' Create the Local Directory Structure to save Local Log File  

24
If objFSO.FolderExisits (objWinDirLoc) = False Then  

25
    objFSO.CreateFolder (objWinDirLoc)  

26
End If  

27
 

28
If objFSO.FolderExisits (objOutputFileParentLoc) = False Then  

29
    objFSO.CreateFolder (objOutputFileParentLoc)  

30
End If  

31
 

32
If objFSO.FolderExisits (objOutputFileDirLoc) = False Then  

33
    objFSO.CreateFolder (objOutputFileDirLoc)  

34
End If  

35
 

36
' Delete any pre-existing %ComputerName%.LoggedUser.csv files saved locally or on ServerName.  

37
If objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = True Then  

38
    objFSO.DeleteFile objOutputFileDirLoc & strComputerName & ".LoggedUser.csv",True  

39
End If  

40
 

41
If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = True Then  

42
    objFSO.DeleteFile objOutputFileDirSrv & strComputerName & ".LoggedUser.csv",True  

43
End If  

44
 

45
' Get WMI information  

46
Set colNetUser = objWMIService.ExecQuery ("SELECT * FROM Win32_NetworkLoginProfile", "WQL", wbemFlagReturnImmediately + wbemFlagForwardOnly)  

47
For Each objNetUser In colNetUser  

48
    strName = objNetUser.Name  

49
    strLastLogon = WMIDateStringToDate(objNetUser.LastLogon)  

50
    strFullName = objNetUser.FullName  

51
    strComment = objNetUser.Comment  

52
    strDescription = objNetUser.Description  

53
    WScript.Echo "strComputerName,strName,strLastLogon,strFullName,strComment,strDescription"  

54
    WScript.Echo strComputerName & "," & strName & "," & strLastLogon & "," & strFullName & "," & strComment & "," & strDescription  

55
    WScript.Echo "======================================="  

56
    If strName <> "NT AUTHORITY\SYSTEM" Then  

57
        If strName <> "NT AUTHORITY\LOCAL SERVICE" Then  

58
            If strName <> "NT AUTHORITY\NETWORK SERVICE" Then  

59
                ' WScript.Echo "This account is not a default Windows account."  

60
                ' Write to Local %ComputerName%.LoggedUser.csv  

61
                If objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = False Then  

62
                    Set objOutputFileLoc = objFSO.CreateTextFile(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv")  

63
                End If  

64
                objOutputFileLoc.Writeline strComputerName & "," & strName & "," & strLastLogon & "," & strFullName & "," & strComment & "," & strDescription  

65
                ' Write to %ComputerName%.LoggedUser.csv on ServerName  

66
                If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = False Then  

67
                    Set objOutputFileSrv = objFSO.CreateTextFile(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv")  

68
                End If  

69
                objOutputFileSrv.Writeline strComputerName & "," & strName & "," & strLastLogon & "," & strFullName & "," & strComment & "," & strDescription  

70
            End If  

71
        End If  

72
    End If  

73
Next  

74
 

75
' Reclaim RAM  

76
Set strName = Nothing 

77
Set strLastLogon = Nothing 

78
Set strFullName = Nothing 

79
Set strComment = Nothing 

80
Set strDescription = Nothing 

81
 

82
'===============================================================================  

83
' Let me know if log saved locally and on server  

84
If objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = True Then  

85
    If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = True Then  

86
        WScript.Quit 111    ' Log saved Locally and on ServerName  

87
    ElseIf objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = False Then  

88
        WScript.Quit 222    ' Log saved Locally, but not on ServerName  

89
    Else  

90
        WScript.Quit 666    ' Something went awry in this script.  

91
    End If  

92
ElseIf objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = False Then  

93
    If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = True Then  

94
        WScript.Quit 333    ' Log NOT saved Locally, but saved on ServerName  

95
    ElseIf objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = False Then  

96
        WScript.Quit 444    ' Log NOT saved Locally or on ServerName  

97
    Else  

98
        WScript.Quit 666    ' Something went awry in this script.  

99
    End If    

100
Else  

101
    WScript.Quit 666    ' Something went awry in this script.  

102
End If  

103
'===============================================================================  

104
 

105
Function WMIDateStringToDate(dtmDate)  

106
WScript.Echo dtm:   

107
    WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) & " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2))  

108
End Function 

Semua Balasan

14 Agustus 2008 17:09

1
I found the following KB article which led me to add the Restore permission (moniker) to my code in line 18 above.

http://support.microsoft.com/kb/816485

Hope this helps anyone else.

Here's the NEW line 18:

Set objWMIService = GetObject("winmgmts:{impersonationLevel=Impersonate, (Restore)}!\\" & strComputer & "\root\CIMV2")
- Ditandai sebagai Jawaban oleh SachinW 08 Oktober 2008 11:57
- Balas
- Kutip
14 April 2013 4:09

Pemilik

0
For those landing here for other WMI questions... Places to ask...

General WMI... http://social.technet.microsoft.com/Forums/en-US/ITCG/threads

If C++... http://social.msdn.microsoft.com/Forums/en-US/vcgeneral/threads

If PowerShell... http://social.technet.microsoft.com/Forums/en-US/winserverpowershell/threads

Thanks!
Ed Price (a.k.a User Ed), SQL Server Customer Program Manager (Blog, Small Basic, Wiki Ninjas, Wiki)

Answer an interesting question? Create a wiki article about it!
- Disarankan sebagai Jawaban oleh Ed Price - MSFTMicrosoft Employee, Owner 14 April 2013 4:10
- Balas
- Kutip

1	Option Explicit
2	On Error Resume Next
3
4	Const wbemFlagReturnImmediately = &h10
5	Const wbemFlagForwardOnly = &h20
6
7	' Declare variables
8	Dim objFSO, objOutputFileLoc, objOutputFileParentLoc, objOutputFileDirLoc, WshNetwork, objWinDirLoc
9	Dim objOutputFileDirSrv, objOutputFileSrv, objWMIService, strComputerName, strComputer
10	Dim colNetUser, objNetUser, strName, strLastLogon, strFullName, strComment, strDescription
11
12	' Set variables
13	strComputer = "."
14	objWinDirLoc = "C:\Windows"
15	objOutputFileParentLoc = objWinDirLoc & "\LocDir"
16	objOutputFileDirLoc = objOutputFileParentLoc & "\LoggedUser\"
17	objOutputFileDirSrv = "\\ServerName\ShareName\LoggedUser\"
18	Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\CIMV2")
19	Set objFSO = CreateObject("Scripting.FileSystemObject")
20	Set WshNetwork = WScript.CreateObject("WScript.Network")
21	strComputerName = WshNetwork.ComputerName
22
23	' Create the Local Directory Structure to save Local Log File
24	If objFSO.FolderExisits (objWinDirLoc) = False Then
25	objFSO.CreateFolder (objWinDirLoc)
26	End If
27
28	If objFSO.FolderExisits (objOutputFileParentLoc) = False Then
29	objFSO.CreateFolder (objOutputFileParentLoc)
30	End If
31
32	If objFSO.FolderExisits (objOutputFileDirLoc) = False Then
33	objFSO.CreateFolder (objOutputFileDirLoc)
34	End If
35
36	' Delete any pre-existing %ComputerName%.LoggedUser.csv files saved locally or on ServerName.
37	If objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = True Then
38	objFSO.DeleteFile objOutputFileDirLoc & strComputerName & ".LoggedUser.csv",True
39	End If
40
41	If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = True Then
42	objFSO.DeleteFile objOutputFileDirSrv & strComputerName & ".LoggedUser.csv",True
43	End If
44
45	' Get WMI information
46	Set colNetUser = objWMIService.ExecQuery ("SELECT * FROM Win32_NetworkLoginProfile", "WQL", wbemFlagReturnImmediately + wbemFlagForwardOnly)
47	For Each objNetUser In colNetUser
48	strName = objNetUser.Name
49	strLastLogon = WMIDateStringToDate(objNetUser.LastLogon)
50	strFullName = objNetUser.FullName
51	strComment = objNetUser.Comment
52	strDescription = objNetUser.Description
53	WScript.Echo "strComputerName,strName,strLastLogon,strFullName,strComment,strDescription"
54	WScript.Echo strComputerName & "," & strName & "," & strLastLogon & "," & strFullName & "," & strComment & "," & strDescription
55	WScript.Echo "======================================="
56	If strName <> "NT AUTHORITY\SYSTEM" Then
57	If strName <> "NT AUTHORITY\LOCAL SERVICE" Then
58	If strName <> "NT AUTHORITY\NETWORK SERVICE" Then
59	' WScript.Echo "This account is not a default Windows account."
60	' Write to Local %ComputerName%.LoggedUser.csv
61	If objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = False Then
62	Set objOutputFileLoc = objFSO.CreateTextFile(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv")
63	End If
64	objOutputFileLoc.Writeline strComputerName & "," & strName & "," & strLastLogon & "," & strFullName & "," & strComment & "," & strDescription
65	' Write to %ComputerName%.LoggedUser.csv on ServerName
66	If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = False Then
67	Set objOutputFileSrv = objFSO.CreateTextFile(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv")
68	End If
69	objOutputFileSrv.Writeline strComputerName & "," & strName & "," & strLastLogon & "," & strFullName & "," & strComment & "," & strDescription
70	End If
71	End If
72	End If
73	Next
74
75	' Reclaim RAM
76	Set strName = Nothing
77	Set strLastLogon = Nothing
78	Set strFullName = Nothing
79	Set strComment = Nothing
80	Set strDescription = Nothing
81
82	'===============================================================================
83	' Let me know if log saved locally and on server
84	If objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = True Then
85	If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = True Then
86	WScript.Quit 111 ' Log saved Locally and on ServerName
87	ElseIf objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = False Then
88	WScript.Quit 222 ' Log saved Locally, but not on ServerName
89	Else
90	WScript.Quit 666 ' Something went awry in this script.
91	End If
92	ElseIf objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = False Then
93	If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = True Then
94	WScript.Quit 333 ' Log NOT saved Locally, but saved on ServerName
95	ElseIf objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = False Then
96	WScript.Quit 444 ' Log NOT saved Locally or on ServerName
97	Else
98	WScript.Quit 666 ' Something went awry in this script.
99	End If
100	Else
101	WScript.Quit 666 ' Something went awry in this script.
102	End If
103	'===============================================================================
104
105	Function WMIDateStringToDate(dtmDate)
106	WScript.Echo dtm:
107	WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) & " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2))
108	End Function