查找某月删除的账户信息
On Error Resume Next
strComputer = "dl-ex-01"
Set OperationRegistry=WScript.CreateObject("WScript.Shell")
DesktopPath=OperationRegistry.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop")
DesktopPath=OperationRegistry.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop")
strDefaultMonth = Month(now) & "-" & Year(now)
'Wscript.echo strDefaultMonth
strMonth = InputBox("请输入你要查询的月份,注意输入格式:月份-年份","月份",strDefaultMonth)
'Wscript.echo strDefaultMonth
strMonth = InputBox("请输入你要查询的月份,注意输入格式:月份-年份","月份",strDefaultMonth)
arrTemp = split(strMonth,"-")
'Wscript.echo arrTemp(0),arrTemp(1)
'Wscript.echo arrTemp(0),arrTemp(1)
if strMonth = "" then
wscript.quit
end if
strStartDate = arrTemp(0) & "/1/" & arrTemp(1)
'Wscript.echo strStartDate
'Wscript.echo UBound(arrTemp)
'Wscript.echo LBound(arrTemp)
If UBound(arrTemp) <> 1 OR strMonth = "" Then
Wscript.echo "输入错误!脚本退出。"
Wscript.Quit
Else
Wscript.echo "点击确定，开始查询，请稍后。"
If arrTemp(0) = "12" Then
strEndDate = "1/" & "1/" & arrTemp(1)+1
Else strEndDate = arrTemp(0)+1 & "/1/" & arrTemp(1)
End If
End If
wscript.quit
end if
strStartDate = arrTemp(0) & "/1/" & arrTemp(1)
'Wscript.echo strStartDate
'Wscript.echo UBound(arrTemp)
'Wscript.echo LBound(arrTemp)
If UBound(arrTemp) <> 1 OR strMonth = "" Then
Wscript.echo "输入错误!脚本退出。"
Wscript.Quit
Else
Wscript.echo "点击确定，开始查询，请稍后。"
If arrTemp(0) = "12" Then
strEndDate = "1/" & "1/" & arrTemp(1)+1
Else strEndDate = arrTemp(0)+1 & "/1/" & arrTemp(1)
End If
End If
Set objSWbemDateTime = CreateObject("WbemScripting.SWbemDateTime")
Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")
Set dtmLogTime = CreateObject("WbemScripting.SWbemDateTime")
'Wscript.echo strStartDate & strEndDate
dtmStartDate.SetVarDate strStartDate, True
dtmEndDate.SetVarDate strEndDate, True
Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")
Set dtmLogTime = CreateObject("WbemScripting.SWbemDateTime")
'Wscript.echo strStartDate & strEndDate
dtmStartDate.SetVarDate strStartDate, True
dtmEndDate.SetVarDate strEndDate, True
Set fso=createobject("scripting.filesystemobject")
strFileName = arrTemp(1) & "年" & arrTemp(0) & "月"
resoultfilepath= DesktopPath & "\" & strFileName & "域账户删除清单" & ".html"
'wSCRIPT.ECHO resoultfilepath
Set resultFile= fso.createtextfile(resoultfilepath,,true)
strFileName = arrTemp(1) & "年" & arrTemp(0) & "月"
resoultfilepath= DesktopPath & "\" & strFileName & "域账户删除清单" & ".html"
'wSCRIPT.ECHO resoultfilepath
Set resultFile= fso.createtextfile(resoultfilepath,,true)
HtmlWriteHead()
'Html文档开始
'Html文档开始
TableHead()
'Set objWMIService = GetObject("winmgmts:{(Security)}\\" & strComputer & "\root\cimv2")
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate,(Security)}!\\" & strComputer & "\root\cimv2")
strSql = "SELECT * FROM Win32_NTLogEvent WHERE LogFile = 'Security' AND " & "EventCode = 538 AND TimeWritten >= '" & dtmStartDate.Value & "' and TimeWritten < '" & dtmEndDate.Value & "'"
'Wscript.echo strSql
Set colEvents = objWMIService.ExecQuery(strSql)
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate,(Security)}!\\" & strComputer & "\root\cimv2")
strSql = "SELECT * FROM Win32_NTLogEvent WHERE LogFile = 'Security' AND " & "EventCode = 538 AND TimeWritten >= '" & dtmStartDate.Value & "' and TimeWritten < '" & dtmEndDate.Value & "'"
'Wscript.echo strSql
Set colEvents = objWMIService.ExecQuery(strSql)
For Each objEvents In colEvents
dtmLogTime.Value = objEvents.TimeGenerated
' Wscript.echo dtmLogTime.GetVarDate(False)
strTime = dtmLogTime.GetVarDate(False)
dtmLogTime.Value = objEvents.TimeGenerated
' Wscript.echo dtmLogTime.GetVarDate(False)
strTime = dtmLogTime.GetVarDate(False)
' strTime = Left(strDate,4) & _
' "-" & mid(strDate,5,2) & _
' "-" & mid(strDate,7,2) & _
' " " & mid(strDate,9,2) & _
' ":" & mid(strDate,11,2) & _
' ":" & mid(strDate,13,2) &
strOpUser = objEvents.User
strOpPc = objEvents.computername
strDelUser =mid(objEvents.Message,22,8)
WriteTable strTime,strOpUser,strOpPc,strDelUser
Next
' "-" & mid(strDate,5,2) & _
' "-" & mid(strDate,7,2) & _
' " " & mid(strDate,9,2) & _
' ":" & mid(strDate,11,2) & _
' ":" & mid(strDate,13,2) &
strOpUser = objEvents.User
strOpPc = objEvents.computername
strDelUser =mid(objEvents.Message,22,8)
WriteTable strTime,strOpUser,strOpPc,strDelUser
Next
TableEnd() 'Html表格结尾
HtmlWriteEnd()
'Html文档结束
'Html文档结束
ResultFile.close
Wscript.Echo " 查询完成！查询结果放置在当前用户的桌面上： " & vbCrLf & " " & DesktopPath
Wscript.Echo " 查询完成！查询结果放置在当前用户的桌面上： " & vbCrLf & " " & DesktopPath
set wshShell = WSCRIPT.createobject("WSCRIPT.SHELL")
strCmd = "Explorer " & resoultfilepath
wshShell.Run strCmd
strCmd = "Explorer " & resoultfilepath
wshShell.Run strCmd
Function WriteTable(sTime,sOpUser,sOpPc,sDelUser)
'函数，将数据写入HTML单元格
resultFile.Writeline "<tr>"
resultFile.Writeline "<td align=""left"" ;"35%"" height=""25"" bgcolor=""#ffffff"" scope=""row""> " & sTime & "</td>"
resultFile.Writeline "<td align=""left"" ;"25%"" height=""25"" bgcolor=""#ffffff"" scope=""row""> " & sOpUser & "</td>"
resultFile.Writeline "<td align=""left"" ;"15%"" height=""25"" bgcolor=""#ffffff"" scope=""row""> " & sOpPc & "</td>"
resultFile.Writeline "<td bgcolor=""#ffffff""> " & sDelUser & "</td>"
resultFile.Writeline "</tr>"
End Function
'函数，将数据写入HTML单元格
resultFile.Writeline "<tr>"
resultFile.Writeline "<td align=""left"" ;"35%"" height=""25"" bgcolor=""#ffffff"" scope=""row""> " & sTime & "</td>"
resultFile.Writeline "<td align=""left"" ;"25%"" height=""25"" bgcolor=""#ffffff"" scope=""row""> " & sOpUser & "</td>"
resultFile.Writeline "<td align=""left"" ;"15%"" height=""25"" bgcolor=""#ffffff"" scope=""row""> " & sOpPc & "</td>"
resultFile.Writeline "<td bgcolor=""#ffffff""> " & sDelUser & "</td>"
resultFile.Writeline "</tr>"
End Function
Function HtmlWriteHead()
'函数，写入THML文件头
resultFile.Writeline "<html>"
resultFile.Writeline "<head>"
resultFile.Writeline "<title>账户删除清单</title>"
resultFile.Writeline "</head>"
resultFile.Writeline "<body>"
resultFile.Writeline "<h3>" & strFileName & " 账户删除清单，记录日期:"&now()&" </h3>" & VbCrLf
End Function
'函数，写入THML文件头
resultFile.Writeline "<html>"
resultFile.Writeline "<head>"
resultFile.Writeline "<title>账户删除清单</title>"
resultFile.Writeline "</head>"
resultFile.Writeline "<body>"
resultFile.Writeline "<h3>" & strFileName & " 账户删除清单，记录日期:"&now()&" </h3>" & VbCrLf
End Function
Function HtmlWriteEnd()
'函数，写入Html文件尾
resultFile.Writeline "</body>"
resultFile.Writeline "</html>"
End Function
'函数，写入Html文件尾
resultFile.Writeline "</body>"
resultFile.Writeline "</html>"
End Function
Function TableHead()
'函数，写入Html表格结尾
resultFile.Writeline "<table ;"90%"" border=""0"" align=""center"" cellpadding=""0"" cellspacing=""1"" bgcolor=""#0000ff"">"
resultFile.Writeline "<tr>"
resultFile.Writeline "<th ;"35%"" height=""25"" bgcolor=""#ffffff"" scope=""col"">时间</th>"
resultFile.Writeline "<th ;"25%"" height=""25"" bgcolor=""#ffffff"" scope=""col"">操作人</th>"
resultFile.Writeline "<th ;"15%"" height=""25"" bgcolor=""#ffffff"" scope=""col"">操作主机</th>"
resultFile.Writeline "<th bgcolor=""#ffffff"" scope=""col"">删除对象</th>"
resultFile.Writeline "</tr>"
strstyle = "<th ;"25%"" height=""25"" bgcolor=""#ffffff"" scope=""row"">"
End Function
'函数，写入Html表格结尾
resultFile.Writeline "<table ;"90%"" border=""0"" align=""center"" cellpadding=""0"" cellspacing=""1"" bgcolor=""#0000ff"">"
resultFile.Writeline "<tr>"
resultFile.Writeline "<th ;"35%"" height=""25"" bgcolor=""#ffffff"" scope=""col"">时间</th>"
resultFile.Writeline "<th ;"25%"" height=""25"" bgcolor=""#ffffff"" scope=""col"">操作人</th>"
resultFile.Writeline "<th ;"15%"" height=""25"" bgcolor=""#ffffff"" scope=""col"">操作主机</th>"
resultFile.Writeline "<th bgcolor=""#ffffff"" scope=""col"">删除对象</th>"
resultFile.Writeline "</tr>"
strstyle = "<th ;"25%"" height=""25"" bgcolor=""#ffffff"" scope=""row"">"
End Function
Function TableEnd()
'函数，Html表格结尾
resultFile.Writeline "</table>"
End Function
'函数，Html表格结尾
resultFile.Writeline "</table>"
End Function