VBS: 查看用户在那一台机登陆

 这个vbs是用于查看用户在那一台机登陆，主要用于日常系统管理之用，所以并不是考虑各种可能出现的情况，请根据自己的系统情况作适当的调试。

intNumberID = 4624 ' Event ID Number; 4634: logoff, 4624: logon
strdc = "dc1" 'domain contraller
struser = "steven.thibault"
str2 = "Source Network Address"

Set objWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strdc & "\root\cimv2")
Set colLoggedEvents = objWMI.ExecQuery ("Select * from Win32_NTLogEvent Where Logfile = 'Security'" )

For Each objEvent in colLoggedEvents
If objEvent.EventCode = intNumberID Then
    If InStr(objEvent.message, struser) Then
    'dim a() as STIRNG
    'msgbox(objEvent.message)
    a=split(objEvent.message,vbcrlf)
    'vbcrlf:回车换行 vbcr:回车 vblf:换行
    For i = 0 To UBound(a)
        'msgbox(a(i))
        If InStr(a(i),struser) Then
        msgbox(a(i))
        End If
        If InStr(a(i),str2) Then
        '大小写有关
        msgbox(a(i))
        End If
    Next
    msgbox(objEvent.TimeWritten)
    Exit for
    End if
End if
next