'查看指定登录类型的事件日志
strComputer = "."

Set wbemServices = Getobject("winmgmts:\\" & strComputer)
Set wbemObjectSet = wbemServices.InstancesOf("Win32_NTLogEvent")

For Each wbemObject In wbemObjectSet
If wbemObject.EventCode = "528" And InStr(wbemObject.Message,"登录类型: 	2") Then
    WScript.Echo "Log File:        " & wbemObject.LogFile        & vbCrLf & _
        "Record Number:   " & wbemObject.RecordNumber   & vbCrLf & _
        "Type:            " & wbemObject.Type           & vbCrLf & _
        "Time Generated:  " & wbemObject.TimeGenerated  & vbCrLf & _
        "Source:          " & wbemObject.SourceName     & vbCrLf & _
        "Category:        " & wbemObject.Category       & vbCrLf & _
        "Category String: " & wbemObject.CategoryString & vbCrLf & _
        "Event:           " & wbemObject.EventCode      & vbCrLf & _
        "User:            " & wbemObject.User           & vbCrLf & _
        "Computer:        " & wbemObject.ComputerName   & vbCrLf & _
        "Message:         " & wbemObject.Message        & vbCrLf
End If
Next
复制代码

rem 列举事件日志类型
wmic Path Win32_NTEventlogFile get LogfileName /value|more

rem 查询应用程序事件日志
wmic Path Win32_NTLogEvent Where "Logfile='Application' and EventCode='1800'" get * /value|more

rem 查询安全事件日志
wmic Path Win32_NTLogEvent Where "Logfile='Security' and EventCode='528'" get * /value|more
复制代码