Yet another script for logs backup, WMI error SWbemServicesEx: A security package specific error occurred.

[xnav...@gmail.com]

Hi everyone,

I'm trying to modify a visual basic script to meet my requirements, these are, a script which takes a backup of the windows log for a set of machines in the same domain. There are machines with Windows 2003, 2008 and 2008 R2.

The script is working fine when I run it from Windows 2003, but if I try to run from Windows 2008 R2 then I'm unable to retrieve the logs from other machines than the one the script is running on.

So, say I'm running from HOSTA which is a Windows 2008 R2 and connecting to the HOSTB which is a Windows 2003, the following command is executed without error:

"Set objWMIService = GetObject ("winmgmts:{impersonationLevel=Delegate,(Security,Backup)}!\\" & strComputer & "\root\cimv2")"

But when I get to "Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile where LogFileName='" _
& strEventLogName & "'")"

Then I get the following error on the command line:

"SWbemServicesEx: A security package specific error occurred."

As I mentioned the script runs smoothly the other way around, this is, from 2003 connecting to a 2008 R2.

I leave attached the full code below, any help would be greatly appreciated.

Best Regards,

Xavier Naveira

--

If WScript.Arguments.Count > 1 Then
WScript.Echo
WScript.Echo "Usage: cscript ""Save Event Logs.vbs"" [computer name]"
WScript.Echo
WScript.Quit
End If

Dim backup_server
backup_server = "\\IGSE01"
Dim Servers : Servers = Array("SEUPPMG003", "SEUPPMS002")

Dim strComputer ' As String

For Each strComputer in Servers
SaveEventLogs strComputer
Next

WScript.Echo "Done"

Private Sub SaveEventLogs(strComputer)
WScript.Echo "Saving event logs on " & strComputer & "..."
SaveEventLog strComputer, "Application"
SaveEventLog strComputer, "Security"
SaveEventLog strComputer, "System"
SaveEventLog strComputer, "Directory Service"
SaveEventLog strComputer, "File Replication Service"
End Sub

Private Sub SaveEventLog(strComputer, strEventLogName)

Set objWMIService = GetObject ("winmgmts:{impersonationLevel=Delegate,(Security,Backup)}!\\" & strComputer & "\root\cimv2")

Set colPrivileges = objWMIService.Security_.Privileges

For i = 1 To 27
colPrivileges.Add i
Next

Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile where LogFileName='" _
& strEventLogName & "'")

For Each objLogfile in colLogFiles
wscript.echo strComputer & ": " & objLogFile.name
Dim backupFilename
backupFilename = backup_server & "\eventlogs$\"

If (Not strComputer = "localhost") Then
backupFilename = backupFilename & strComputer & "_"
End If

backupFilename = backupFilename & strEventLogName & "_" _
& GetFormattedTimestamp() & ".evt"

'wscript.echo backupFilename
errBackupLog = objLogFile.BackupEventLog(backupFilename)
wscript.echo "ERROR: " & errBackupLog
If errBackupLog <> 0 Then
WScript.Echo "The " & strEventLogName & " event log on " _
& strComputer & " could not be backed up."
Else
objLogFile.ClearEventLog()
End If
Next
End Sub

Private Function GetFormattedTimestamp
Dim timestamp
timestamp = Now

GetFormattedTimestamp = Year(timestamp) _
& LPad(Month(timestamp), 2, "0") _
& LPad(Day(timestamp), 2, "0") _
& "_" & Replace(FormatDateTime(timestamp, 4),":","")

End Function

Private Function LPad(strValue, nLength, strPadCharacter)
Dim strPaddedValue

strPaddedValue = strValue

While (Len(strPaddedValue) < nLength)
strPaddedValue = strPadCharacter & strPaddedValue
WEnd

LPad = strPaddedValue
End Function