Re: RE: Resolve SID & FS input

cvengelen — Thu, 07 Aug 2008 07:15:05 GMT

[quote user="Anonymous"]

Regarding Jr's problem: try with "oEVTInputFormat.resolveSIDs = True". When you say it doesn't work, what do you mean? Does CScript give you an error, or just you don't see SID's being resolved?

[/quote]

I'm using JScript to execute a query on Security event logs, and use the following lines to resolve the SID's (taken from the Log Parser Help file):

//Create EventLog input format
var objEventLogInputFormat = new ActiveXObject( "MSUtil.LogQuery.EventLogInputFormat" );
// Resolve SIDs
objEventLogInputFormat.resolveSIDs = true;

However, this does not work, since the SID in my output is not resolved. I use the followinq query:

SELECT RecordNumber, SourceName, TimeGenerated, SID, ComputerName, EXTRACT_TOKEN(Strings, 13, '|') as SourceNetworkAddress, Message FROM R:\temp\LogQueryWorkDir\Security.2008-07-02-16-50-42.evt WHERE eventID = 528 ORDER BY RecordNumber, TimeGenerated

and the output , which I generate with the toNativeString method, still shows the SID unresolved I removed everything after the SID for safety):

7, Security, 2008-07-02 10:16:22, S-1-5-21-2046926873-3586635073-1646930892-2756, ......

Is this caused by using the toNativeString method?

Search results matching tag 'JScript EventLogInputFormat resolveSIDs'

Re: RE: Resolve SID & FS input