Software

Our forums are currently in maintenance mode and the ability to post is disabled. We will be back up and running as soon as possible. Thanks for your patience!

Question

Locked

WMI - Win32_NetworkLoginProfile Inconsistency

By Juice1169 ·
Hi. I apologize if I am posting this in the wrong area, but I have been puzzling over this issue and don't quite know where to go from here. If this is the wrong arena, please direct me to the correct one.

I am using Scriptomatic to query the WMI Class - Win32_NetworkLoginProfile. I am able to query my local computer and other computers on the network. Reviewing the results from the other computers on the network, I am able to garner all sorts of information about all the accounts that have logged onto each computer. However, when I query my local computer, I only get the NT AUTHORITY\SYSTEM, the NT AUTHORITY\LOCAL SERVICE, the NT AUTHORITY\NETWORK SERVICE and the current logged on user information. I do not get the complete information I would if querying it remotely.

I have gone to another computer and verified I can pull all users' info from my original computer. So I know the info is there ... I am just having an issue pulling it from the local computer.

I would like to write a VBS that will run in the local system account and pull info about all users who have logged in and write to a local log file and a network log file. I have the script written, but just can't get all the info I know is there.

Here's the script:
' Option Explicit
On Error Resume Next

Const wbemFlagReturnImmediately = &h10
Const wbemFlagForwardOnly = &h20

' Declare variables
Dim objFSO, objOutputFileLoc, objOutputFileParentLoc, objOutputFileDirLoc, WshNetwork, objWinDirLoc
Dim objOutputFileDirSrv, objOutputFileSrv, objWMIService, strComputerName, strComputer
Dim colNetUser, objNetUser, strName, strLastLogon, strFullName, strComment, strDescription

' Set variables
strComputer = "."
objWinDirLoc = "C:\Windows"
objOutputFileParentLoc = objWinDirLoc & "\ADMigration"
objOutputFileDirLoc = objOutputFileParentLoc & "\LoggedUser\"
objOutputFileDirSrv = "\\ServerName\ShareName\LoggedUser\"
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\CIMV2")
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set WshNetwork = WScript.CreateObject("WScript.Network")
strComputerName = WshNetwork.ComputerName

' Create the Local Directory Structure to save Local Log File
If objFSO.FolderExisits (objWinDirLoc) = False Then
objFSO.CreateFolder (objWinDirLoc)
End If

If objFSO.FolderExisits (objOutputFileParentLoc) = False Then
objFSO.CreateFolder (objOutputFileParentLoc)
End If

If objFSO.FolderExisits (objOutputFileDirLoc) = False Then
objFSO.CreateFolder (objOutputFileDirLoc)
End If

' Delete any pre-existing %ComputerName%.LoggedUser.csv files saved locally or on ServerName.
If objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = True Then
objFSO.DeleteFile objOutputFileDirLoc & strComputerName & ".LoggedUser.csv",True
End If

If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = True Then
objFSO.DeleteFile objOutputFileDirSrv & strComputerName & ".LoggedUser.csv",True
End If

' Get WMI information
Set colNetUser = objWMIService.ExecQuery ("SELECT * FROM Win32_NetworkLoginProfile", "WQL", wbemFlagReturnImmediately + wbemFlagForwardOnly)
For Each objNetUser In colNetUser
strName = objNetUser.Name
strLastLogon = WMIDateStringToDate(objNetUser.LastLogon)
strFullName = objNetUser.FullName
strComment = objNetUser.Comment
strDescription = objNetUser.Description
WScript.Echo "strComputerName,strName,strLastLogon,strFullName,strComment,strDescription"
WScript.Echo strComputerName & "," & strName & "," & strLastLogon & "," & strFullName & "," & strComment & "," & strDescription
WScript.Echo "======================================="
If strName <> "NT AUTHORITY\SYSTEM" Then
If strName <> "NT AUTHORITY\LOCAL SERVICE" Then
If strName <> "NT AUTHORITY\NETWORK SERVICE" Then
' WScript.Echo "This account is not a default Windows account."
' Write to Local %ComputerName%.LoggedUser.csv
If objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = False Then
Set objOutputFileLoc = objFSO.CreateTextFile(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv")
End If
objOutputFileLoc.Writeline strComputerName & "," & strName & "," & strLastLogon & "," & strFullName & "," & strComment & "," & strDescription
' Write to %ComputerName%.LoggedUser.csv on ServerName
If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = False Then
Set objOutputFileSrv = objFSO.CreateTextFile(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv")
End If
objOutputFileSrv.Writeline strComputerName & "," & strName & "," & strLastLogon & "," & strFullName & "," & strComment & "," & strDescription
End If
End If
End If
Next

' Reclaim RAM
Set strName = Nothing
Set strLastLogon = Nothing
Set strFullName = Nothing
Set strComment = Nothing
Set strDescription = Nothing

'===============================================================================
' Let me know if log saved locally and on server
If objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = True Then
If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = True Then
WScript.Quit 111 ' Log saved Locally and on ServerName
ElseIf objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = False Then
WScript.Quit 222 ' Log saved Locally, but not on ServerName
Else
WScript.Quit 666 ' Something went awry in this script.
End If
ElseIf objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = False Then
If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = True Then
WScript.Quit 333 ' Log NOT saved Locally, but saved on ServerName
ElseIf objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = False Then
WScript.Quit 444 ' Log NOT saved Locally or on ServerName
Else
WScript.Quit 666 ' Something went awry in this script.
End If
Else
WScript.Quit 666 ' Something went awry in this script.
End If
'===============================================================================

Function WMIDateStringToDate(dtmDate)
WScript.Echo dtm:
WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) & " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2))
End Function

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Answers

Collapse -

WMI - Win32_NetworkLoginProfile Inconsistency Solved

by Juice1169 In reply to WMI - Win32_NetworkLoginP ...

I found the following KB article which led me to add the Restore permission (moniker) to my code in line 18 above. I would still like a better explanation of why ... but my script works like a champ now.

http://support.microsoft.com/kb/816485

Hope this helps anyone else.

Here's the NEW line 18:

Set objWMIService = GetObject("winmgmts:{impersonationLevel=Impersonate, (Restore)}!\\" & strComputer & "\root\CIMV2")

Related Discussions

Related Forums