Question

Locked

WMI - Win32_NetworkLoginProfile Inconsistency

By Juice1169 ·
Hi. I apologize if I am posting this in the wrong area, but I have been puzzling over this issue and don't quite know where to go from here. If this is the wrong arena, please direct me to the correct one.

I am using Scriptomatic to query the WMI Class - Win32_NetworkLoginProfile. I am able to query my local computer and other computers on the network. Reviewing the results from the other computers on the network, I am able to garner all sorts of information about all the accounts that have logged onto each computer. However, when I query my local computer, I only get the NT AUTHORITY\SYSTEM, the NT AUTHORITY\LOCAL SERVICE, the NT AUTHORITY\NETWORK SERVICE and the current logged on user information. I do not get the complete information I would if querying it remotely.

I have gone to another computer and verified I can pull all users' info from my original computer. So I know the info is there ... I am just having an issue pulling it from the local computer.

I would like to write a VBS that will run in the local system account and pull info about all users who have logged in and write to a local log file and a network log file. I have the script written, but just can't get all the info I know is there.

Here's the script:
' Option Explicit
On Error Resume Next

Const wbemFlagReturnImmediately = &h10
Const wbemFlagForwardOnly = &h20

' Declare variables
Dim objFSO, objOutputFileLoc, objOutputFileParentLoc, objOutputFileDirLoc, WshNetwork, objWinDirLoc
Dim objOutputFileDirSrv, objOutputFileSrv, objWMIService, strComputerName, strComputer
Dim colNetUser, objNetUser, strName, strLastLogon, strFullName, strComment, strDescription

' Set variables
strComputer = "."
objWinDirLoc = "C:\Windows"
objOutputFileParentLoc = objWinDirLoc & "\ADMigration"
objOutputFileDirLoc = objOutputFileParentLoc & "\LoggedUser\"
objOutputFileDirSrv = "\\ServerName\ShareName\LoggedUser\"
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\CIMV2")
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set WshNetwork = WScript.CreateObject("WScript.Network")
strComputerName = WshNetwork.ComputerName

' Create the Local Directory Structure to save Local Log File
If objFSO.FolderExisits (objWinDirLoc) = False Then
objFSO.CreateFolder (objWinDirLoc)
End If

If objFSO.FolderExisits (objOutputFileParentLoc) = False Then
objFSO.CreateFolder (objOutputFileParentLoc)
End If

If objFSO.FolderExisits (objOutputFileDirLoc) = False Then
objFSO.CreateFolder (objOutputFileDirLoc)
End If

' Delete any pre-existing %ComputerName%.LoggedUser.csv files saved locally or on ServerName.
If objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = True Then
objFSO.DeleteFile objOutputFileDirLoc & strComputerName & ".LoggedUser.csv",True
End If

If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = True Then
objFSO.DeleteFile objOutputFileDirSrv & strComputerName & ".LoggedUser.csv",True
End If

' Get WMI information
Set colNetUser = objWMIService.ExecQuery ("SELECT * FROM Win32_NetworkLoginProfile", "WQL", wbemFlagReturnImmediately + wbemFlagForwardOnly)
For Each objNetUser In colNetUser
strName = objNetUser.Name
strLastLogon = WMIDateStringToDate(objNetUser.LastLogon)
strFullName = objNetUser.FullName
strComment = objNetUser.Comment
strDescription = objNetUser.Description
WScript.Echo "strComputerName,strName,strLastLogon,strFullName,strComment,strDescription"
WScript.Echo strComputerName & "," & strName & "," & strLastLogon & "," & strFullName & "," & strComment & "," & strDescription
WScript.Echo "======================================="
If strName <> "NT AUTHORITY\SYSTEM" Then
If strName <> "NT AUTHORITY\LOCAL SERVICE" Then
If strName <> "NT AUTHORITY\NETWORK SERVICE" Then
' WScript.Echo "This account is not a default Windows account."
' Write to Local %ComputerName%.LoggedUser.csv
If objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = False Then
Set objOutputFileLoc = objFSO.CreateTextFile(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv")
End If
objOutputFileLoc.Writeline strComputerName & "," & strName & "," & strLastLogon & "," & strFullName & "," & strComment & "," & strDescription
' Write to %ComputerName%.LoggedUser.csv on ServerName
If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = False Then
Set objOutputFileSrv = objFSO.CreateTextFile(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv")
End If
objOutputFileSrv.Writeline strComputerName & "," & strName & "," & strLastLogon & "," & strFullName & "," & strComment & "," & strDescription
End If
End If
End If
Next

' Reclaim RAM
Set strName = Nothing
Set strLastLogon = Nothing
Set strFullName = Nothing
Set strComment = Nothing
Set strDescription = Nothing

'===============================================================================
' Let me know if log saved locally and on server
If objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = True Then
If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = True Then
WScript.Quit 111 ' Log saved Locally and on ServerName
ElseIf objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = False Then
WScript.Quit 222 ' Log saved Locally, but not on ServerName
Else
WScript.Quit 666 ' Something went awry in this script.
End If
ElseIf objFSO.FileExists(objOutputFileDirLoc & strComputerName & ".LoggedUser.csv") = False Then
If objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = True Then
WScript.Quit 333 ' Log NOT saved Locally, but saved on ServerName
ElseIf objFSO.FileExists(objOutputFileDirSrv & strComputerName & ".LoggedUser.csv") = False Then
WScript.Quit 444 ' Log NOT saved Locally or on ServerName
Else
WScript.Quit 666 ' Something went awry in this script.
End If
Else
WScript.Quit 666 ' Something went awry in this script.
End If
'===============================================================================

Function WMIDateStringToDate(dtmDate)
WScript.Echo dtm:
WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) & " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2))
End Function

This conversation is currently closed to new comments.

1 total post (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Answers

Collapse -

WMI - Win32_NetworkLoginProfile Inconsistency Solved

by Juice1169 In reply to WMI - Win32_NetworkLoginP ...

I found the following KB article which led me to add the Restore permission (moniker) to my code in line 18 above. I would still like a better explanation of why ... but my script works like a champ now.

http://support.microsoft.com/kb/816485

Hope this helps anyone else.

Here's the NEW line 18:

Set objWMIService = GetObject("winmgmts:{impersonationLevel=Impersonate, (Restore)}!\\" & strComputer & "\root\CIMV2")

Back to Software Forum
1 total post (Page 1 of 1)  

Related Discussions

Related Forums