Break On 

;region Log Parser
If @INWIN = 1 And Not InStr(@PRODUCTTYPE," NT")
	Dim $oLogQuery
	$oLogQuery = CreateObject("MSUtil.LogQuery")
	If VarType($oLogQuery) = 9
		;User logons
		Dim $Data,$What,$Where,$Order
		$Order = "To_String(TimeGenerated, 'yyyy-MM-ddThh:mm:ss')"
		If InStr(@PRODUCTTYPE," 2000") Or InStr(@PRODUCTTYPE," XP") Or InStr(@PRODUCTTYPE," 2003")
			$What = "Case EventID When 528 Then 'Logon' When 551 Then 'Logoff' END, To_String(TimeGenerated, 'yyyy-MM-ddThh:mm:ss')"
			$What = $What+", RESOLVE_SID(SID), SID"
			$Where = "EventID = 551 Or EventID = 528 AND (EXTRACT_TOKEN(Strings,3,'|')='2' Or EXTRACT_TOKEN(Strings,3,'|')='10') And EXTRACT_TOKEN(Strings,4,'|') like 'User32%'"
		Else
			$What = "Case EventID When 4624 Then 'Logon' When 4647 Then 'Logoff' END, To_String(TimeGenerated, 'yyyy-MM-ddThh:mm:ss')"
			$What = $What+", Case EventID When 4624 Then RESOLVE_SID(EXTRACT_TOKEN(Strings,4,'|'))"
			$What = $What+" When 4647 Then RESOLVE_SID(EXTRACT_TOKEN(Strings,0,'|')) END"
			$What = $What+", Case EventID When 4624 Then EXTRACT_TOKEN(Strings,4,'|') When 4647 Then EXTRACT_TOKEN(Strings,0,'|') END"
			$Where = "EventID = 4647 Or (EventID = 4624 AND (EXTRACT_TOKEN(Strings,8,'|')='2' Or EXTRACT_TOKEN(Strings,8,'|')='11')"
			$Where = $Where+" And EXTRACT_TOKEN(Strings,9,'|') like 'User32%'"
			$Where = $Where+" And EXTRACT_TOKEN(Strings,12,'|')='{00000000-0000-0000-0000-000000000000}')"
		EndIf
		$Data = LogToDataTable($oLogQuery,"Security","UserLogs",$What,$Where,$Order)
	EndIf
EndIf

Function LogToDataTable($oLogQuery, $Source, $Checkpoint, $sFields, Optional $Criteria, $Order)
		
	Dim $oEventLog, $oRecordSet,$Query
	$oEventLog = CreateObject("MSUtil.LogQuery.EventLogInputFormat")
	$oEventLog.iCheckPoint = %windir% + "\system32\logs\" + $Checkpoint + ".lpc"
	If Not Exist(%windir%+"\system32\logs\")
		MD %windir%+"\system32\logs\"
	EndIf
	$Query = "Select Distinct "+$sFields+" from "+$Source+IIf($Criteria," where "+$Criteria,"")+IIf($Order," order by "+$Order,"")
	$oRecordSet = $oLogQuery.Execute($Query, $oEventLog)
	While Not $oRecordSet.atEnd
		$LogToDataTable = Push($LogToDataTable, Split($oRecordSet.getRecord.toNativeString(Chr(1)), Chr(1)))
		$oRecordSet.moveNext
	Loop
		
EndFunction
;endregion

Function Push($a,$s)
	
	Dim $i
	$i = UBound($a)+1
	ReDim Preserve $a[$i]
	$a[$i] = $s
	$Push = $a
	
EndFunction