如何在Delphi中查询与安全相关的Win32_NTLogEvent

时间:2018-08-14 17:33:35

标签: security delphi logging wmi

我正在尝试将VBScript代码转换为Delphi以检测登录尝试,在Delphi中查找wmi代码,我发现theroadtodelphi.com这个页面提供了代码和示例,其中wmi查询了所有这些代码和示例很好,但是当我尝试以下查询(脚本中的查询)

"SELECT * FROM __InstanceCreationEvent WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.Logfile = 'Security' AND TargetInstance.EventType = 5 AND (TargetInstance.EventIdentifier = 529 OR TargetInstance.EventIdentifier = 4625) AND (TargetInstance.SourceName = 'Security' OR TargetInstance.SourceName = 'Microsoft-Windows-Security-Auditing')"

一无所获,似乎安全事件需要特殊处理,因此深入研究脚本代码,我发现了一种创建wmi对象的特殊方法:

Set objWMIService = GetObject("winmgmts:{(security)}!root/cimv2")
' Create event sink to catch security events
Set objEventSink = WScript.CreateObject("WbemScripting.SWbemSink", "eventSink_")
objWMIService.ExecNotificationQueryAsync objEventSink, "SELECT * FROM __InstanceCreationEvent WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.Logfile = 'Security' AND TargetInstance.EventType = 5 AND (TargetInstance.EventIdentifier = 529 OR TargetInstance.EventIdentifier = 4625) AND (TargetInstance.SourceName = 'Security' OR TargetInstance.SourceName = 'Microsoft-Windows-Security-Auditing')"

我没有办法用这些属性创建wmi对象。 有人可以指导我纠正如何在Delphi中使用所需属性创建wmi对象的方法吗?

0 个答案:

没有答案