Finding Logged on Users and More Scripting Secrets
(Page 1 of 5 )
Welcome back for the fourth installment of Nilpo’s Scripting Secrets. If you missed the first three articles in this series, this is where I present collections of useful script bits that perform useful tasks or present scripting workarounds that might not otherwise be possible in scripting. I’ve got some good stuff in store for you today, so let’s jump right in.
The first script I want to present to you is a very useful script that will enumerate all of the STOP or bug check errors on a system. These are commonly referred to as BSODs or errors that result in a Blue Screen Of Death. This script is especially handy for network administrators who want to poll an entire network of computers for trouble spots, or for technicians who are profiling a troublesome machine. Heck, it's even good for the average user to inspect a computer for problems they might not even know exist!
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!" & strComputer & "rootcimv2")
This script starts off the same way as any other WMI script. VBScript's GetObject method is used to connect to the local WMI service in the rootcimv2 namespace. This is where all of the most common WMI classes are found.
Set colLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'System'" _
& " and SourceName = 'SaveDump'")
Next we query the System Event Log for entries that have the source name "SaveDump." This is the name used by Windows any time that it logs a BSOD error. Of course, your system will have to have logging enabled or it won't be creating event log entries in the first place. If you're not sure what I'm talking about, don't worry; it's enabled by default.
For Each objEvent in colLoggedEvents
Wscript.Echo "Event date: " & objEvent.TimeGenerated
Wscript.Echo "Description: " & objEvent.Message
Next
The WMI query will return a collection of events from the event log. A simple For loop can be used to move through each of them and print some information about the errors. The TimeGenerated and Message properties are probably the most useful. They return the time when the BSOD occurred and the associated error message, respectively.
Next: More on BSODs >>
More BrainDump Articles
More By Nilpo
