Parse security eventlog with vbscript - vbscript

Question

I found this code on your site VBscript to get the properties of event from event ID and modified it to pars a different section of the security event log message however I don't get any results.
Set wmi = GetObject("winmgmts://./root/cimv2")
Set re = New RegExp
re.Pattern = "New Logon:\s+" & _
"Security ID:\s*(.*?)\s+" & _
"Account Name:\s*(.*?)\s+" & _
"Account Domain:\s*(.*?)\s+" & _
"Logon ID:\s*(.*?)\s+" & _
"Logon GUID:\s*(\d+)"
qry = "SELECT * FROM Win32_NTLogEvent WHERE EventCode=4624"
For Each evt In wmi.ExecQuery(qry)
For Each m In re.Execute(evt.Message)
Security_ID = m.SubMatches(0)
Account_Name = m.SubMatches(1)
Account_Domain = m.SubMatches(2)
Logon_ID = m.SubMatches(3)
Logon_GUID = m.SubMatches(4)
WScript.Echo "Yes"
Next
WScript.Echo "New Logon" & Account_Name & " " & Account_Domain & " " & Logon_ID
WScript.Echo " "
Next
What am I doing wrong?

Answer 1

Important:
reformulated Pattern property (Logon GUID);
Cosmetic:
option explicit and ON ERROR GOTO 0 as a matter of general principle;
where clause in the wmi query extended merely to reasonably limit output range;
more extensive echo for debugging purposes;
mm instead of m variable: I hate one-letter names...
The script:
option explicit
ON ERROR GOTO 0
Dim re, qry, evt, mm, wmi
Set re = New RegExp
re.Pattern = "New Logon:\s+" _
& "Security ID:\s*(.*?)\s+" _
& "Account Name:\s*(.*?)\s+" _
& "Account Domain:\s*(.*?)\s+" _
& "Logon ID:\s*(.*?)\s+" _
& "Logon GUID:\s*({.*?})"
' re.IgnoreCase = True ' Set case insensitivity.
' re.Global = True ' Set global applicability.
qry = "SELECT * FROM Win32_NTLogEvent WHERE logfile='security'" _
& " and EventCode=4624 " _
& " and (RecordNumber = 36413 or RecordNumber = 44911)"
Dim Security_ID, Account_Name, Account_Domain, Logon_ID, Logon_GUID
Set wmi = GetObject("winmgmts://./root/cimv2")
For Each evt In wmi.ExecQuery(qry)
For Each mm In re.Execute(evt.Message)
Security_ID = mm.SubMatches(0)
Account_Name = mm.SubMatches(1)
Account_Domain= mm.SubMatches(2)
Logon_ID = mm.SubMatches(3)
Logon_GUID = mm.SubMatches(4)
WScript.Echo "Yes " & evt.TimeGenerated
Next
WScript.Echo "New Logon " & Account_Name & "," & Account_Domain & "," & Logon_ID
WScript.Echo "Logon_GUID " & Logon_GUID
Next
Output (administrator command prompt console):
==>cscript.exe D:\VB_scripts\SO\30291316.vbs
Yes 20150517203428.318232-000
New Logon ANONYMOUS LOGON,NT AUTHORITY,0x3C70F59
Logon_GUID {00000000-0000-0000-0000-000000000000}
Yes 20150518073715.217688-000
New Logon SYSTEM,NT AUTHORITY,0x3E7
Logon_GUID {00000000-0000-0000-0000-000000000000}
==>