Windows Admin Scripting Little Black Book- P20 potx

3. Select Start|Run and enter “kix32 scriptfile”.
Here, scriptfile is the full path of the new directory from step 1 and file name of a script file that contains the
following:
$RCODE = BackUpEventLog ("Security", "C:\BACKUP.EVT")
If @ERROR <> 0 or $RCODE <> 0
? "Error backing up log"
End If
Clearing the Event Log
ClearEventLog is a KiXtart command that allows you to clear the contents of an event log. The basic syntax for
using the ClearEventLog command is as follows:
ClearEventLog ("logtype")

Tip
You can clear the event log of a remote computer by including the UNC path before the log type, for
example:

ClearEventLog ("\\computer\Security")
Here, logtype is the type of log to clear (Application, System, or Security). To clear the event log using KiXtart,
proceed as follows:
1. Create a new directory to store all files included in this example.
2. Download and extract the latest version of KiXtart, from www.microsoft.com
, to the new directory.
3. Select Start|Run and enter “kix32 scriptfile”.
Here, scriptfile is the full path of the new directory from step 1 and file name of a script file that contains the
following:
$RCODE = ClearEventLog ("Security")
If @ERROR <> 0 or $RCODE <> 0
? "Error clearing the event log"
End If

Using Logs with Windows Script Host

Windows Script Host allows you to write events to a text log and the event log using simple script files. This allows
you to store critical events in the event log, while storing less severe events to a text log.

Note
Windows Script Host does not contain any methods to read or modify events in the event log.
Writing to Text Logs
Text logs provide an easy way to record events and share the file with others, regardless of operating system. To log
an event to a text log using Windows Script Host, proceed as follows:
1. Create a new directory to store all files included in this example.
2. Download and install the latest version of Windows Script Host, from www.microsoft.com
, to the new
directory.
3. Select Start|Run and enter “cscript scriptfile.vbs”.
Here, scriptfile is the full path and file name of a script file that contains the following:
On Error Resume Next
Set FSO = CreateObject("Scripting.FileSystemObject")
txtlog = "textlog"

If FSO.FileExists(txtlog) Then
Set LogFile = FSO.OpenTextFile(txtlog, 8)
Else
Set LogFile = FSO.CreateTextFile(txtlog, True)
End If
LogFile.WriteLine Date & " " & Time & " message"
LogFile.Close
Here, message is the alert message to log, and textlog is the complete path and file name of the log file.
Related solution: Found on page:
Appending Text Files 81
Writing an Event to the Event Log
You can use Wscript.Shell’s LogEvent method to write events to the event log. The basic syntax for using the

LogEvent method is as follows:
LogEvent(type,event,computer)

Note
All events are stored in the application log, and cannot be redirected to the system or security logs.
Here, event is the text event entry; computer is an optional parameter specifying the name of a remote system to
write events to; and type specifies one of the following event types:
 SUCCESS (0)
 ERROR (1)
 WARNING (2)
 INFORMATION (4)
 AUDIT_SUCCESS (8)
 AUDIT_FAILURE (16)

Tip
You can use the corresponding numbers, as opposed to key words, to specify event types.
When you use LogEvent to create an event log entry, the following is recorded:
 Category—Logged as None
 Computer—The name of the target computer
 Date—Date the event was written
 Event—Logged as 0
 Source Type—Logged as WSH
 Time—Time the event was written
 Type—Type of event entry
 User Name—Logged as N/A
Here is a subroutine to write an event:
Sub WriteLog(Ltype, Ldesc)
On Error Resume Next
Set SHELL = CreateObject("WScript.Shell")
LEvent = SHELL.LogEvent(Ltype, Ldesc)

If Err.Number <> 0 Or LEvent = False Then
Wscript.Echo "Error writing event"
End If
End Sub

Note
Because Windows 9x does not contain an event log, all written events will be stored in
%WINDIR%\wsh.log.
Here, ltype is the type of event, and ldesc is the event text to write. Using the following command combined with the
subroutine above will write a success event to the event log:
WriteLog 0, "This stuff is cool!"

Accessing the Event Log Using WMI
The Win32_NTLogEvent class manages the event logs on Windows NT/2000 systems. Through this class, you can
view, write, modify, delete, and back up the event log through simple scripts.
Backing Up an Event Log in Binary Mode
The BackupEventLog method allows you to back up an event log to a file in standard event log binary format. To
create a backup of the event log in standard event log binary format using WMI, proceed as follows:
1. Create a new directory to store all files included in this example.
2. Download and install the latest version of WMI and Windows Script Host, from www.microsoft.com
, to the
new directory.
3. Select Start|Run and enter “cscript scriptfile.vbs”.
Here, scriptfile is the full path and file name of a script file that contains the following:
On Error Resume Next
Set FSO = CreateObject("Scripting.FileSystemObject")
LogType = InputBox("Enter the log to backup", "Log Type"
, "application")

BFile = InputBox("Enter file to backup to", "Backup File"

, "C:\BACKUP.LOG")
If FSO.FileExists(BFile) Then
FSO.DeleteFile BFile
End If
Set EventLog = GetObject("winmgmts:{impersonationLevel=
impersonate,(Backup)}").ExecQuery("select * from
Win32_NTEventLogFile where LogfileName='" & LogType & "'")

For each Entry in EventLog
Entry.BackupEventLog BFile
Next
Wscript.Echo "Done"

Note
The highlighted code above must be placed on one line. The (Backup) privilege is explicitly included
in the example above to allow you to use the BackUpEventLog method.
Here, LogType is the event log to back up (application, security, or system), and Bfile is the complete path and
filename to back up to.
Backing Up the Entire Event Log in Text Mode
In the previous sections, you learned that the BackUpEventLog method and the Dumpel utility back up the event log
to a text file in binary format. Although this format conforms to the standard event log storage format, it does not
allow you to easily view the contents of the backup. To create a backup of the event log in plain-text, tab-delimited
format using WMI, proceed as follows:
1. Create a new directory to store all files included in this example.
2. Download and install the latest version of WMI and Windows Script Host, from www.microsoft.com
, to the
new directory.
3. Select Start|Run and enter “cscript scriptfile.vbs”.
Here, scriptfile is the full path and file name of a script file that contains the following:
On Error Resume Next

Set EventLog = GetObject("winmgmts:{impersonationLevel=
impersonate}").ExecQuery("select * from Win32_NTLogEvent")

Set FSO = CreateObject("Scripting.FileSystemObject")
Set txt = FSO.CreateTextFile("textfile", True)
For each Entry in EventLog
If Len(Entry.Message) > 0 Then
For x = 1 to Len(Entry.Message)
Char = Mid(Entry.Message,x,1)
If Asc(Char) = 10 Then
MSG = MSG & " "
ElseIf Asc(Char) <> 13 Then
MSG = MSG & Char
End If
Next

EDate = Mid(Entry.TimeGenerated,5,2) & "/" & _
Mid(Entry.TimeGenerated,7,2) & "/" & _
Mid(Entry.TimeGenerated,1,4)
ETime = Mid(Entry.TimeGenerated,9,2) & ":" & _
Mid(Entry.TimeGenerated,11,2) & ":" & _
Mid(Entry.TimeGenerated,13,2)
ETime = FormatDateTime(ETime,3)

If IsNull(Entry.User) Then
User = "N/A"
Else
User = Entry.User
End If

If IsNull(Entry.CategoryString) Then
Category = "none"
Else
Category = Entry.CategoryString
End If

EVT = Entry.LogFile & VBtab & _
Entry.Type & VBtab & _
EDate & VBtab & _
ETime & VBtab & _
Entry.SourceName & VBtab & _
Category & VBtab & _
Entry.EventCode & VBtab & _
User & VBtab & _
Entry.ComputerName & VBtab & _
MSG
txt.writeline EVT

EVT = Null
Char = Null
MSG = Null
End If
Next
txt.close
Wscript.echo "Done"

Note
The highlighted code above must be placed on one line.
Here, textfile is the complete path and file name to back up the event log to.
Clearing an Event Log

The ClearEventLog method allows you to clear individual event log entries. To clear the entire contents of an event
log using WMI, proceed as follows:
1. Create a new directory to store all files included in this example.
2. Download and install the latest version of WMI and Windows Script Host, from www.microsoft.com
, to the
new directory.
3. Select Start|Run and enter “cscript scriptfile.vbs”.
Here, scriptfile is the full path and file name of a script file that contains the following:
On Error Resume Next
LogType = InputBox("Enter the log to clear", "Clear Log"
, "application")

Set EventLog = GetObject("winmgmts:{impersonationLevel=
impersonate}").ExecQuery("select * from
Win32_NTEventLogFile where LogfileName='" & LogType & "'")
For each Entry in EventLog
Entry.ClearEventlog()
Next
Wscript.Echo "Done"

Note
The highlighted code above must be placed on one line.
Here, LogType is the event log to clear (Application, Security, or System).


Sending Alerts Using Shell Scripting
Shell scripting does not include a method to send alerts from the command line. Microsoft Windows includes the
NET.EXE utility to allow you to send messages to users or computers over the network.
Sending Alerts to a Single User or Computer
To send a message over the network, start a command prompt and enter the following:

NET SEND name message

Note
NetBIOS messages have a maximum limit of 128 characters.
Here, message is the message to send, and name is the NetBIOS name of a computer or user ID.
Sending Alerts to Multiple Users and Computers
You can also use the asterisk symbol (*) to send messages to all computers on the local network:
Net Send * message
Here, message is the message to send. As opposed to specifying a name or asterisk, you can use one of the
following commands to send messages to multiple users or computers:
 /DOMAIN—Sends a message to the local domain
 /DOMAIN:name—Sends a message to a specified domain
 /USERS—Sends messages to users connected to the server
Here is an example to send a message to the JESSEWEB domain:
Net Send /DOMAIN:JESSEWEB message

Note
Sending messages to the entire network or domain will not only utilize a good portion of your
network’s bandwidth but it is also annoying to all the other users.
Sending Alerts to Specific Multiple Users and Computers
Although the Net Send command contains methods to send messages to multiple users, it does not contain a
method to send messages to specific user and computer names. To send an alert to an exact list of user or computer
names using shell scripting, proceed as follows:
1. Create a new directory to store all files included in this example.
2. Select Start|Run and enter “scriptfile.bat”.
Here, scriptfile is the full path of the new directory from step 1 and file name of a script file that contains the
following:
@Echo Off
For /F %%N in (textfile) Do (Echo Sending Message to
%%N… & Net Send %%N Message)

Note
The highlighted code above must be placed on one line.
Here, textfile is the name of a text file with each line containing a user or computer name, and message is the
message to send.

Sending Alerts Using KiXtart
KiXtart includes a command called SendMessage that allows you to send NetBIOS messages to users or computers
over the network. This command transports messages in a similar fashion to the Microsoft NET.EXE utility.
Sending Alerts to a Single User or Computer
To send an alert to a single user using KiXtart, proceed as follows:
1. Create a new directory to store all files included in this example.
2. Download and extract the latest version of KiXtart, from www.microsoft.com
, to the new directory.
3. Select Start|Run and enter “kix32 scriptfile”.
Here, scriptfile is the full path of the new directory from step 1 and file name of a script file that contains the
following:
$RCODE = SENDMESSAGE ("name", "message")
If @ERROR <> 0 or $RCODE <> 0
? "Error sending message"
End If
Here, name is the user or computer name to send a message to.
Sending Alerts to Multiple Users or Computers
To send an alert to multiple users using KiXtart, proceed as follows:
1. Create a new directory to store all files included in this example.
2. Download and extract the latest version of KiXtart, from www.microsoft.com
, to the new directory.
3. Select Start|Run and enter “kix32 scriptfile”.
Here, scriptfile is the full path of the new directory from step 1 and file name of a script file that contains the
following:

$COUNT = 4 ; User Array Count
DIM $NAME[$COUNT] ; User Array
$NAME[0] = "name1"
$NAME[1] = "computer1"
$NAME[2] = "computer2"
$NAME[3] = "name2"

$NETMESSAGE = "This is a test message."

$Index = 0
WHILE $Index <> $COUNT
$RCODE = SENDMESSAGE ($NAME[$Index], $NETMESSAGE)
If @ERROR <> 0 or $RCODE <> 0
? "Error sending message"
End If
$Index = $Index + 1
LOOP
Here, $count is the size of the array. This is the number of users you want to send messages to. This number must
exactly match the number of users that you send messages to, or an error will result. $name is the array that holds
the user or computer names to send messages to, and $netmessage is the message to send.

Note
The array size is limited to the amount of memory the system has. Remember, the contents of an
array start at 0, not at 1. Using versions older than KiXtart 3.62 will cause a script error when
attempting to create an array.


Sending Alerts Using Windows Script Host
Windows Script Host does not include any methods to send messages to users or computers. Through Windows
Script Host, you can call upon the NET.EXE utility or use automation to send messages.

Sending an Alert to a Single User or Computer
To send an alert to a single user or computer using WSH, proceed as follows:
1. Create a new directory to store all files included in this example.
2. Download and install the latest version of Windows Script Host, from www.microsoft.com
, to the new
directory.
3. Select Start|Run and enter “cscript scriptfile.vbs”.
Here, scriptfile is the full path and file name of a script file that contains the following:
On Error Resume Next
Set Shell = CreateObject("Wscript.Shell")

RCV = "name"
MSG = "message"

SHELL.Run "Net Send " & Name & " " & MSG, 0, False
Here, RCV is the user or computer name to send a message to, and MSG is the message to send.
Sending Alerts to Multiple Users or Computers
To send an alert to multiple user or computer names using WSH, proceed as follows:
1. Create a new directory to store all files included in this example.
2. Download and install the latest version of Windows Script Host, from www.microsoft.com
, to the new
directory.
3. Select Start|Run and enter “cscript scriptfile.vbs”.
Here, scriptfile is the full path and file name of a script file that contains the following:
On Error Resume Next
Set Shell = CreateObject("Wscript.Shell")

Dim Name(2)
Name(0) = "name1"
Name(1) = "name2"

MSG = "message"

For X = 0 to UBound(Name)
SHELL.Run "Net Send " & Name(X) & " " & MSG, 0, False
Next
Here, Name is the array that holds the user or computer names to send messages to. The size of this array should
be equal to the number of users or computers you want to send messages to. MSG is the message to send.
Sending an Email Using Outlook Automation
To send an email using Outlook automation, proceed as follows:
1. Create a new directory to store all files included in this example.
2. Download and install the latest version of Windows Script Host, from www.microsoft.com
, to the new
directory.
3. Select Start|Run and enter “cscript scriptfile.vbs”.
Here, scriptfile is the full path and file name of a script file that contains the following:
On Error Resume Next
RCP = "emailaddress"
SUB = "subject"
MSG = "message"

Set Outlook = CreateObject("Outlook.Application")
Set MAPI = Outlook.GetNameSpace("MAPI")
Set NewMail = Outlook.CreateItem(0)
NewMail.Subject = SUB
NewMail.Body = MSG
NewMail.Recipients.Add RCP

MAPI.Logon "profile", "password"
NewMail.Send

MAPI.Logoff
Here, RCP stores the email address to email; SUB is the email subject; MSG is the message to send; and profile
and password are the logon credentials to send the email.

Tip
You can omit the highlighted lines above if you do not need to log on to a mail server or if your
information is cached.
Sending an Email with Attachments Using Outlook Automation
To send an email to multiple users with attachments using Outlook, proceed as follows:
1. Create a new directory to store all files included in this example.
2. Download and install the latest version of Windows Script Host, from www.microsoft.com
, to the new
directory.
3. Select Start|Run and enter “cscript scriptfile.vbs”.
Here, scriptfile is the full path and file name of a script file that contains the following:
On Error Resume Next
RCP = "emailaddress"
Dim File(2)
File(0) = "file1"
File(1) = "file2"

SUB = "subject"
MSG = "message"

Set Outlook = CreateObject("Outlook.Application")
Set MAPI = Outlook.GetNameSpace("MAPI")
Set NewMail = Outlook.CreateItem(0)
NewMail.Subject = SUB
NewMail.Body = MSG
NewMail.Recipients.Add RCP

For X = 0 to (UBound(File)-1)
NewMail.Attachments.Add(file(X))
Next

MAPI.Logon "profile", "password"
NewMail.Send
MAPI.Logoff
Here, file is the array that holds the file names to attach to the message; RCP stores the email address to email;
SUB is the email subject; MSG is the message to send; and profile and password are the logon credentials to
send the email.

Tip
You can omit the highlighted lines above if you do not need to log on to a mail server or if your
information is cached.
Sending Emails and Attachments to Multiple Recipients Using Outlook
Automation
To send an email to multiple users with attachments using Outlook, proceed as follows:
1. Create a new directory to store all files included in this example.
2. Download and install the latest version of Windows Script Host, from www.microsoft.com
, to the new
directory.