ShadowFiend

可以把指针移动到TXT文件尾部，然后看最后读取就可以。

直接运行是比较占内存。所以添加wscript.sleep 100  可以缓解一下

ShadowFiend

strComputer = "."

Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colEvents = objWMIService.ExecQuery("Select * from Win32_NTLogEvent WHERE Logfile = 'Security' and EventCode='540' ")

Dim str, objEvent

For each objEvent in colEvents

	str  =  objEvent.Message     ' 这一句出错, 只获取的到 一行,然后报错.. 但是我直接用objEvent.Message.readline  又报错....
	
	If  instr(str,"用户名")<>0     then 
	
	    WScript.Echo   Mid(str, instr(str,"用户名"))
	
	End If

Next
复制代码