Jump to content
Sign in to follow this  

Vista and EventLog.au3 UDF

Recommended Posts


Anyone else having problems with using the EventLog.au3 UDF in Vista? The description of events (13 in the array) comes out as one hard to parse single line string, like:

S-1-5-18LAPTOP$WORKGROUP0x3e7S-1-5-18SYSTEMNT AUTHORITY0x3e75Advapi Negotiate{00000000-0000-0000-0000-000000000000}--00x244C:\Windows\System32\services.exe--

I was trying to write a tool to parse login records. Here is some sample code:

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
;Irongeek's sloppy code for the PEBKAC Attack on the Windows Security Event Log, http://irongeek.com
#include <EventLog.au3>
#include <String.au3>
#include <array.au3>

Func _Main()
    Local $hEventLog

ConsoleWrite ("Irongeek's PEBKAC Attack on the Windows Security Event Log ver .1" & @CRLF)
; Get log to work on
if $CmdLine[0] > 0 then 
    ConsoleWrite ("Working on " & $box & "..." & @CRLF)
$hEventLog = _EventLog__Open( $box, "Security")
;$hEventLog = _EventLog__OpenBackup("", "c:\WINDOWS\system32\config\security")
$x=_EventLog__Count ($hEventLog)
;Iterate through log
For $i=0 To $x
    $aEvent = _EventLog__Read($hEventLog)
    ;if $aEvent[6] = "4624" then
        for $j=0 to 14
        ConsoleWrite($j & ":   " & $aEvent[$j] & @CRLF )
        ;msgbox(0,"",$aEvent[13] & @CRLF )
        ;$gooduser=GrabUsername ($aEvent[13])
        ;ConsoleWrite ("Successful  Login (" & $aEvent[1] & "): " & $gooduser & @CRLF)

EndFunc   ;==>_Main

Func GrabUsername($eventdescription)
    $aArray =_StringBetween($eventdescription,"User Name:", @cr)
    If IsArray($aArray) Then
        return StringStripWS($aArray[0], 1)

In XP, at least the description looks like what you see in event viewer. Ideas?

Edited by Irongeek

Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this