strComputer = “.”
Set SWBemlocator = CreateObject(“WbemScripting.SWbemLocator”)
Set objWMIService = SWBemlocator.ConnectServer(strComputer, _
“\root\CIMV2”,UserName,Password)
Set colItems = _
objWMIService.ExecQuery(“Select * from Win32_NTLogEvent”)
For Each objItem in colItems
If objItem.EventIdentifier = 1073741925 Then
WScript.Echo “TimeGenerated: ” & objItem.TimeGenerated
WScript.Echo “TimeWritten: ” & objItem.TimeWritten
WScript.Echo “User: ” & objItem.User
End If
Next
