Re: WMI Date works on XP but not 2000 Server
From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 04/19/05
- Next message: Niel Bullock: "Re: WMI Date works on XP but not 2000 Server"
- Previous message: Roger Abell: "Re: WMI Date works on XP but not 2000 Server"
- In reply to: nbullock: "WMI Date works on XP but not 2000 Server"
- Next in thread: Niel Bullock: "Re: WMI Date works on XP but not 2000 Server"
- Reply: Niel Bullock: "Re: WMI Date works on XP but not 2000 Server"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 18 Apr 2005 20:51:38 -0700
For use in W2k you will need to build a function for conversion of
Windows dates to those of WMI as the class you are attempting to
use does not exist in the earlier implementation of WMI.
I attach info from an older version of the WMI documentation that
should allow for you to do so.
--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
<quote>
Date and Time Format
All dates and times in Windows Management Instrumentation (WMI) use the
format designed by the Distributed Management Task Force (DMTF). The format
is a fixed-length string.
The string contains several fields:
yyyymmddHHMMSS.mmmmmmsUUU
The following table describes each of the fields in the format.
yyyy
Four-digit year (0000 through 9999). Implementations can restrict the
supported range. For example, an implementation can support only the years
1980 through 2099.
mm
Two-digit month (01 through 12).
dd
Two-digit day of the month (01 through 31). This value must be appropriate
for the month. For example, February 31 is invalid. Implementations,
however, are not required to check for valid data.
HH
Two-digit hour of the day using the 24-hour clock (00 through 23).
MM
Two-digit minute in the hour (00 through 59).
SS
Two-digit number of seconds in the minute (00 through 59).
mmmmmm
Six-digit number of microseconds in the second (000000 through 999999).
Implementations are not required to support evaluation using this field, but
this field must always be present in the string to preserve the string's
fixed-length nature.
s
Plus sign (+) or minus sign (-) to indicate a positive or negative offset
from Universal Time Coordinates (UTC).
UUU
Three-digit offset indicating the number of minutes that the originating
time zone deviates from UTC. For WMI, it is encouraged, but not required, to
convert times to GMT with a UTC offset of zero.
Note
On Microsoft® Windows NT®/Windows® 2000 systems, WMI does not accept a date
earlier than January 1, 1601.
All fields must be of the indicated length, using leading zeros as
appropriate for the type.
You can use asterisks to indicate unused fields. An unused field indicates
no particular value for that field and can be used everywhere except the
WHERE clause of a query. For example, a date and time with an unspecified
year can occur in any year. If a field is to be unspecified, the entire
field must be replaced by asterisks. You cannot replace, for example, one
out of the required four digits for the year:
19980416******.000000+*** // Legal
199*0416******.000000+*** // Illegal
Although a date-time format with unspecified fields is meant to convey only
the data that is specified, an application can interpret such a format as
occurring in the current year, time, day, and/or time zone. Not specifying a
particular field indicates lack of interest in an absolute point in the
calendar, but instead interest in a relative point. For example, "April
first" is relative to some unspecified year but is still a defined point if
the level of measurement detail is one day:
****0401******.000000+***
Unzoned time can be specified by placing asterisks in the UUU field after
either the plus or minus sign:
19980401135809.000000+***
19980401135809.000000-***
An unzoned date and time is interpreted with reference to a local, abstract
chronometer within the executing operating system. For example, portable
computers can have internal clocks whose settings may or may not correspond
to the geographical time zone. Unzoned time must be interpreted by
substituting the time zone of the current abstract time source rather than
the local time zone.
Special consideration must be given to the meaning of the UTC offset with
dates and times in queries. In general, equivalence, greater-than, or less
than comparisons will work between two dates and times if they are of the
same UTC offset. Dates and times occurring with different time zone offsets
will first be converted to GMT, and the resulting times will then be
compared.
Queries involving relative dates and times, those with asterisks in one or
more subfields, are only meaningful when compared for equivalence. Further,
use of asterisks as wildcards is not allowed; relative dates and times will
be compared on a character-for-character basis. For example, the following
two times are not equivalent:
19980401135809.000000+***
19980401135809.000000+000
Built on Wednesday, February 09, 2000
</quote>
"nbullock" <niel_bullock@hotmail.com> wrote in message
news:uAZArTIRFHA.580@TK2MSFTNGP15.phx.gbl...
> I am trying to log failed logon attempts to Active Directory. I found
this
> example and it works on my XP Pro pc. But it . However:
> ("WbemScripting.SWbemDateTime") will not work on 2000.
>
> We like the idea of logging yesterdays events, and then writing custom
> reports on the data. Does anyone have any suggestions??
>
> Many Thanks
>
>
> Set objConn = CreateObject("ADODB.Connection")
> Set objRS = CreateObject("ADODB.Recordset")
>
> objConn.Open "DSN=EventLogs;"
> objRS.CursorLocation = 3
> objRS.Open "SELECT * FROM EventTable" , objConn, 3, 3
>
>
> Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
> Set dtmEndDate = CreateObject ("WbemScripting.SWbemDateTime")
>
> DateToCheck = Date - 1
> dtmEndDate.SetVarDate Date, True
> dtmStartDate.SetVarDate DateToCheck, True
>
> strComputer = "."
> Set objWMIService = GetObject("winmgmts:" _
> & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
>
> Set colEvents = objWMIService.ExecQuery _
> ("Select * from Win32_NTLogEvent Where TimeWritten >= '" _
> & dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "'")
>
> For each objEvent in colEvents
> objRS.AddNew
> objRS("Category") = objEvent.Category
> objRS("ComputerName") = objEvent.ComputerName
> objRS("EventCode") = objEvent.EventCode
> objRS("Message") = objEvent.Message
> objRS("RecordNumber") = objEvent.RecordNumber
> objRS("SourceName") = objEvent.SourceName
> objRS("TimeWritten") = objEvent.TimeWritten
> objRS("Type") = objEvent.Type
> objRS("User") = objEvent.User
> objRS.Update
> Next
>
> objRS.Close
> objConn.Close
>
>
- Next message: Niel Bullock: "Re: WMI Date works on XP but not 2000 Server"
- Previous message: Roger Abell: "Re: WMI Date works on XP but not 2000 Server"
- In reply to: nbullock: "WMI Date works on XP but not 2000 Server"
- Next in thread: Niel Bullock: "Re: WMI Date works on XP but not 2000 Server"
- Reply: Niel Bullock: "Re: WMI Date works on XP but not 2000 Server"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
