Re: WMI Date works on XP but not 2000 Server

• Previous message: Roger Abell: "Re: WMI Date works on XP but not 2000 Server"
• In reply to: Roger Abell: "Re: WMI Date works on XP but not 2000 Server"
• Next in thread: Torgeir Bakken \(MVP\): "Re: WMI Date works on XP but not 2000 Server"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Mon, 18 Apr 2005 23:11:45 -0500

Thanks -
 Okay - so I need covert Now() so it can be compared to: "TimeWritten" .
I am sure it will be clear after some sleep.

"Roger Abell" <mvpNOSpam@asu.edu> wrote in message
news:OKErYKJRFHA.1096@tk2msftngp13.phx.gbl...
> For use in W2k you will need to build a function for conversion of
> Windows dates to those of WMI as the class you are attempting to
> use does not exist in the earlier implementation of WMI.
>
> I attach info from an older version of the WMI documentation that
> should allow for you to do so.
>
> --
> Roger Abell
> Microsoft MVP (Windows Security)
> MCSE (W2k3,W2k,Nt4) MCDBA
>
> <quote>
> Date and Time Format
> All dates and times in Windows Management Instrumentation (WMI) use the
> format designed by the Distributed Management Task Force (DMTF). The
format
> is a fixed-length string.
>
> The string contains several fields:
> yyyymmddHHMMSS.mmmmmmsUUU
>
> The following table describes each of the fields in the format.
>
> yyyy
> Four-digit year (0000 through 9999). Implementations can restrict the
> supported range. For example, an implementation can support only the years
> 1980 through 2099.
>
> mm
> Two-digit month (01 through 12).
>
> dd
> Two-digit day of the month (01 through 31). This value must be appropriate
> for the month. For example, February 31 is invalid. Implementations,
> however, are not required to check for valid data.
>
> HH
> Two-digit hour of the day using the 24-hour clock (00 through 23).
>
> MM
> Two-digit minute in the hour (00 through 59).
>
> SS
> Two-digit number of seconds in the minute (00 through 59).
>
> mmmmmm
> Six-digit number of microseconds in the second (000000 through 999999).
> Implementations are not required to support evaluation using this field,
but
> this field must always be present in the string to preserve the string's
> fixed-length nature.
>
> s
> Plus sign (+) or minus sign (-) to indicate a positive or negative offset
> from Universal Time Coordinates (UTC).
>
> UUU
> Three-digit offset indicating the number of minutes that the originating
> time zone deviates from UTC. For WMI, it is encouraged, but not required,
to
> convert times to GMT with a UTC offset of zero.
>
>
> Note
> On Microsoft® Windows NT®/Windows® 2000 systems, WMI does not accept a
date
> earlier than January 1, 1601.
>
> All fields must be of the indicated length, using leading zeros as
> appropriate for the type.
>
> You can use asterisks to indicate unused fields. An unused field indicates
> no particular value for that field and can be used everywhere except the
> WHERE clause of a query. For example, a date and time with an unspecified
> year can occur in any year. If a field is to be unspecified, the entire
> field must be replaced by asterisks. You cannot replace, for example, one
> out of the required four digits for the year:
> 19980416******.000000+*** // Legal
> 199*0416******.000000+*** // Illegal
> Although a date-time format with unspecified fields is meant to convey
only
> the data that is specified, an application can interpret such a format as
> occurring in the current year, time, day, and/or time zone. Not specifying
a
> particular field indicates lack of interest in an absolute point in the
> calendar, but instead interest in a relative point. For example, "April
> first" is relative to some unspecified year but is still a defined point
if
> the level of measurement detail is one day:
> ****0401******.000000+***
> Unzoned time can be specified by placing asterisks in the UUU field after
> either the plus or minus sign:
> 19980401135809.000000+***
> 19980401135809.000000-***
> An unzoned date and time is interpreted with reference to a local,
abstract
> chronometer within the executing operating system. For example, portable
> computers can have internal clocks whose settings may or may not
correspond
> to the geographical time zone. Unzoned time must be interpreted by
> substituting the time zone of the current abstract time source rather than
> the local time zone.
> Special consideration must be given to the meaning of the UTC offset with
> dates and times in queries. In general, equivalence, greater-than, or less
> than comparisons will work between two dates and times if they are of the
> same UTC offset. Dates and times occurring with different time zone
offsets
> will first be converted to GMT, and the resulting times will then be
> compared.
> Queries involving relative dates and times, those with asterisks in one or
> more subfields, are only meaningful when compared for equivalence.
Further,
> use of asterisks as wildcards is not allowed; relative dates and times
will
> be compared on a character-for-character basis. For example, the following
> two times are not equivalent:
> 19980401135809.000000+***
> 19980401135809.000000+000
> Built on Wednesday, February 09, 2000
> </quote>
>
>
> "nbullock" <niel_bullock@hotmail.com> wrote in message
> news:uAZArTIRFHA.580@TK2MSFTNGP15.phx.gbl...
> > I am trying to log failed logon attempts to Active Directory. I found
> this
> > example and it works on my XP Pro pc. But it . However:
> > ("WbemScripting.SWbemDateTime") will not work on 2000.
> >
> > We like the idea of logging yesterdays events, and then writing custom
> > reports on the data. Does anyone have any suggestions??
> >
> > Many Thanks
> >
> >
> > Set objConn = CreateObject("ADODB.Connection")
> > Set objRS = CreateObject("ADODB.Recordset")
> >
> > objConn.Open "DSN=EventLogs;"
> > objRS.CursorLocation = 3
> > objRS.Open "SELECT * FROM EventTable" , objConn, 3, 3
> >
> >
> > Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
> > Set dtmEndDate = CreateObject ("WbemScripting.SWbemDateTime")
> >
> > DateToCheck = Date - 1
> > dtmEndDate.SetVarDate Date, True
> > dtmStartDate.SetVarDate DateToCheck, True
> >
> > strComputer = "."
> > Set objWMIService = GetObject("winmgmts:" _
> > & "{impersonationLevel=impersonate}!\\" & strComputer &
"\root\cimv2")
> >
> > Set colEvents = objWMIService.ExecQuery _
> > ("Select * from Win32_NTLogEvent Where TimeWritten >= '" _
> > & dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "'")
> >
> > For each objEvent in colEvents
> > objRS.AddNew
> > objRS("Category") = objEvent.Category
> > objRS("ComputerName") = objEvent.ComputerName
> > objRS("EventCode") = objEvent.EventCode
> > objRS("Message") = objEvent.Message
> > objRS("RecordNumber") = objEvent.RecordNumber
> > objRS("SourceName") = objEvent.SourceName
> > objRS("TimeWritten") = objEvent.TimeWritten
> > objRS("Type") = objEvent.Type
> > objRS("User") = objEvent.User
> > objRS.Update
> > Next
> >
> > objRS.Close
> > objConn.Close
> >
> >
>
>

• Previous message: Roger Abell: "Re: WMI Date works on XP but not 2000 Server"
• In reply to: Roger Abell: "Re: WMI Date works on XP but not 2000 Server"
• Next in thread: Torgeir Bakken \(MVP\): "Re: WMI Date works on XP but not 2000 Server"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]