{"id":15103,"date":"2021-12-17T16:10:52","date_gmt":"2021-12-17T16:10:52","guid":{"rendered":"https:\/\/lgildv5i97.onrocket.site\/answers\/?post_type=question&p=15103"},"modified":"2021-12-17T16:11:27","modified_gmt":"2021-12-17T16:11:27","slug":"vbs-to-wmic-returnvalue-123","status":"publish","type":"question","link":"https:\/\/computing.net\/answers\/programming\/vbs-to-wmic-returnvalue-123\/25445.html","title":{"rendered":"VBS To WMIC – ReturnValue = 123"},"content":{"rendered":"

Hi all,
\nI seem to be missing something when I attempt to “convert” a VBS script to WMIC in
\nbatch. Here’s the properly executing VBS:<\/p>\n

 <\/p>\n

dtmThisDay = Day(Date)\r\ndtmThisMonth = Month(Date)\r\ndtmThisYear = Year(Date)\r\nstrBackupName = dtmThisYear & \".\" & dtmThisMonth _\r\n    & \".\" & dtmThisDay\r\nstrComputer = \".\"\r\nSet objWMIService = GetObject(\"winmgmts:\" _\r\n    & \"{impersonationLevel=impersonate,(Backup)}!\\\\\" & _\r\n        strComputer & \"\\root\\cimv2\")\r\nSet colLogFiles = objWMIService.ExecQuery _\r\n    (\"Select * from Win32_NTEventLogFile \" _\r\n        & \"Where LogFileName='Application'\")\r\nFor Each objLogfile in colLogFiles\r\n    objLogFile.BackupEventLog(\"d:\\logs\\EventViewer\\\" _\r\n        & strBackupName & _\r\n        \".application.evt\")\r\n    WScript.Echo \"File saved: \" & strBackupName & _\r\n        \".application.evt\"\r\nNext\r\n<\/pre>\n
Here’s the batch file:<\/p>\n
 <\/p>\n
@ECHO OFF \r\nSETLOCAL\r\n:: Parse date\r\nFOR \/F \"tokens=2-4 delims=\/ \" %%A IN (\"%DATE%\") DO (\r\n    SET MM=%%A\r\n    SET DD=%%B\r\n    SET YY=%%C\r\n)\r\n:: Ensure log directory exists\r\nIF NOT EXIST \"D:\\Logs\\EventViewer\" (\r\n    MKDIR \"D:\\Logs\\EventViewer\"\r\n)\r\n:: Execute WMIC\r\nFOR %%A IN (Application Security System) DO (\r\nWMIC \/PRIVILEGES:ENABLE PATH Win32_NTEventlogFile WHERE LogfileName=\"%%A\" ^\r\n    CALL BackupEventlog(\"D:\\Logs\\EventViewer\\%YY%.%MM%.%DD%.%%A\")\r\n)\r\n:: Leave\r\nEXIT \/B\r\n<\/pre>\n
And here’s the output relating to the Applications Event log:<\/p>\n
 <\/p>\n
Executing (\\\\D610-LAPTOP\\root\\cimv2:Win32_NTEventlogFile.Name=\"C:\\\\WINDOWS\\\\system32\\\\config\\\\AppEvent.Evt\")->BackupEventlog()\r\nMethod execution successful.\r\nOut Parameters:\r\ninstance of __PARAMETERS\r\n{\r\n        ReturnValue = 123;\r\n};\r\n<\/pre>\n
I like that I’m getting “Method execution successful”, but I don’t like
\n“ReturnValue = 123”. I think that it’s the latter that is preventing any file
\ncreation in my “D:\\Logs\\EventViewer” directory. Any clue what “ReturnValue = 123” is?<\/p>\n
When your only tool is a hammer, every problem looks like a nail.<\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"inline_featured_image":false,"iawp_total_views":3},"question-category":[55],"question_tags":[],"class_list":["post-15103","question","type-question","status-publish","hentry","question-category-programming"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/computing.net\/answers\/wp-json\/wp\/v2\/question\/15103","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/computing.net\/answers\/wp-json\/wp\/v2\/question"}],"about":[{"href":"https:\/\/computing.net\/answers\/wp-json\/wp\/v2\/types\/question"}],"author":[{"embeddable":true,"href":"https:\/\/computing.net\/answers\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/computing.net\/answers\/wp-json\/wp\/v2\/comments?post=15103"}],"wp:attachment":[{"href":"https:\/\/computing.net\/answers\/wp-json\/wp\/v2\/media?parent=15103"}],"wp:term":[{"taxonomy":"question-category","embeddable":true,"href":"https:\/\/computing.net\/answers\/wp-json\/wp\/v2\/question-category?post=15103"},{"taxonomy":"question_tags","embeddable":true,"href":"https:\/\/computing.net\/answers\/wp-json\/wp\/v2\/question_tags?post=15103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}