Get windows eventlog and specified time record

'This vbscript is for retrieve windows eventlog "Application" , SourceName="YourService.exe" , EventCode=1 log record
' and then execute c:\maint\batch\execproc.bat to do something

Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
'1440 is one day , "Now - 3/1440" is represent for 3 minutes ago
DateToCheck = Now - 3/1440
dtmStartDate.SetVarDate DateToCheck, True
intNumberID=1
Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")

Set colLoggedEvents = objWMI.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'Application' and TimeWritten >='" & dtmStartDate & "'")

For Each objEvent in colLoggedEvents
If objEvent.EventCode = intNumberID Then
if objEvent.SourceName="YourService.exe" then
Set shell = CreateObject("WScript.Shell")
Set exec = shell.run("c:\maint\batch\execproc.bat")
end if
End if

Next

WScript.Quit

Hide user from exchange address list by msExchHideFromAddressLists

' Setup ADO objects.
Set adoCommand = CreateObject("ADODB.Command")
Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Provider = "ADsDSOObject"
adoConnection.Open "Active Directory Provider"
Set adoCommand.ActiveConnection = adoConnection
' Search entire Active Directory domain.
Set objRootDSE = GetObject("LDAP://RootDSE")

strDNSDomain = objRootDSE.Get("defaultNamingContext")
strBase = ""
' Filter on user objects.
strFilter = "(&(objectCategory=person)(objectClass=user))"

' Comma delimited list of attribute values to retrieve.
strAttributes = "sAMAccountName,cn,distinguishedName"

' Construct the LDAP syntax query.
strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
adoCommand.CommandText = strQuery
adoCommand.Properties("Page Size") = 100
adoCommand.Properties("Timeout") = 30
adoCommand.Properties("Cache Results") = False

' Run the query.
Set adoRecordset = adoCommand.Execute

' Enumerate the resulting recordset.
Do Until adoRecordset.EOF
' Retrieve values and display.
strName = adoRecordset.Fields("sAMAccountName").Value
strDName = adoRecordset.Fields("distinguishedName").Value
strCN = adoRecordset.Fields("cn").value
'Change "test_admin" to your data
if strName="test_admin" then
'Wscript.Echo "NT Name: " & strName & ", distinguishedName: " & strDName
Set oUser = GetObject("LDAP://"&strDName)
oUser.put "msExchHideFromAddressLists", True
oUser.SetInfo
ExchangeAddressList="Disabled"
end if
' Move to the next record in the recordset.
adoRecordset.MoveNext
Loop

' Clean up.
adoRecordset.Close
adoConnection.Close

將 AD 帳號全部 disabled

Const ADS_PROPERTY_UPDATE = 2
' multiple users
Set objOU = GetObject("ldap://cn=Users,dc=king,dc=com,dc=tw/")
' Filter on user objects.'objOU.Filter = Array("user")
' Enumerate user objects.
For Each objUser In objOU
'msgbox("name:"+objUser.name)
On Error Resume Next
objUser.Put "AccountDisabled", True
' Save changes.
objUser.SetInfo
Next
msgbox("Finished!")


若尋找單一 帳號, 可用
Set oUser = GetObject("WinNT://simplo-tw/brian_chang,user")
msgbox(oUser.AccountDisabled)
'True 表示帳號停用狀態中

VBScript - 檢查 Disk 空間, 並寄送通知信

Dim fso, d, s, oArgs, drvPath, threshold, fspace, ret, cmdstr
Const cdoSendUsingPort = 2
Set oArgs=WScript.Arguments
'Set objNewMail = WScript.CreateObject("CDONTS.NewMail")
sch = "http://schemas.microsoft.com/cdo/configuration/"
Set cdoConfig = CreateObject("CDO.Configuration")
With cdoConfig.Fields
.Item(sch & "sendusing") = 2 ' cdoSendUsingPort
.Item(sch & "smtpserver") = "192.168.2.14"
.update
End With
If oArgs.Count < 3 Then Call DisplayUsage
drvPath=oArgs(0)
threshold=CDbl(oArgs(1))
aceno=oArgs(2)+"0151"
'on error resume next

Set fso = CreateObject("Scripting.FileSystemObject")
Set d = fso.GetDrive(fso.GetDriveName(drvPath))
fspace=Round((d.FreeSpace / 1024 /1024),2)
desc="Free Space " + CStr(fspace) + "M < " + CStr(threshold) + "M"
if (fspace < threshold) and (Not IsEmpty(d)) then thistime=cstr(tran(Year(now)))+"/"+cstr(tran(Month(now)))+"/"+cstr(tran(Day(now)))+"" thistime=thistime+cstr(tran(Hour(now)))+":"+cstr(tran(Minute(now)))+":"+cstr(tran(Second(now)))
mail_subject="SAM" + aceno + ": " + drvPath + " " + desc
strBody="start_time=" + thistime
strBody=strBody+"system_type=Windows"
strBody=strBody+"node_name=" + drvPath
strBody=strBody+"object_name=DISK SPACE"
strBody=strBody+"desc=" + desc
Set cdoMessage = CreateObject("CDO.Message")
With cdoMessage
Set .Configuration = cdoConfig
.From = "test@gmail.com"
.To = "test@gmail.com"
.Subject = mail_subject
.htmlbody = strBody
.Send
End With
Set cdoMessage = Nothing
Set cdoConfig = nothing
end if

WScript.Quit

Sub DisplayUsage
dim strUsage
strUsage="Usage: GetFreeSpace [drive] [threshold(MB)] [alert level]" +chr(13)+chr(10)
strUsage=strUsage+"Example: GetFreeSpace \\192.168.1.1\c$ 5000 1"
WScript.Echo strUsage
WScript.Quit
End Sub
function tran(tt)
if int(tt)<10 then
tran="0"&tt
else
tran=tt
end if
end function

VBScript - 刪除兩天以前的檔案

'Delete 2 days ago files

'date
daysAgo = 2

'folder path
dirPath = "D:\\backup\archlog"

Set fs = CreateObject("Scripting.FileSystemObject")
Set w = WScript.CreateObject("WScript.Shell")

Set f = fs.GetFolder(dirPath)
Set fc = f.Files

dateBefore = Now() - daysAgo

For Each ff in fc
fileName = ff.Name
fileDate = ff.DateLastModified

If fileDate < dateBefore Then
fs.DeleteFile(dirPath & "\\" & fileName)
End If
Next