2007-10-24 08:04:06	Daemon.Notice	DC-SERVER	Security: DOMAIN\username: Object Open: Object Server: 
Security Account Manager Object Type: SAM_SERVER Object Name: CN=Server,CN=System,DC=DOMAIN,DC=STATE,DC=AZ,DC=US 
Handle ID: 226087280 Operation ID: {0,639024591} Process ID: 380 Process Name: C:\WINDOWS\system32\lsass.exe 
Primary User Name: DC-SERVER$ Primary Domain: DOMAIN Primary Logon ID: (0x0,0x3E7) Client User Name: username 
Client Domain: DOMAIN Client Logon ID: (0x0,0x2616A3CA) Accesses: (Error 1537) (Error 1538) (Error 1539) (Error 1540) 
(Error 5376) (Error 5377) (Error 5378) (Error 5379) A network adapter malfunction has occurred.<013><010>
The network control block (NCB) request was refused.  The NCB is the data.<013><010> 
The network control block (NCB) command is still pending.<013><010>The NCB is the data.<013><010> (Error 5382) 
(Error 5383) (Error 5384) Privileges: - Properties: --- %{bf967aad-0de6-11d0-a285-00aa003049e2} Access Mask: 0

Break On 

;region Log Parser
If @INWIN = 1 And Not InStr(@PRODUCTTYPE," NT")
	Dim $oLogQuery
	$oLogQuery = CreateObject("MSUtil.LogQuery")
	If VarType($oLogQuery) = 9
		;User logons
		Dim $Data,$What,$Where,$Order
		$Order = "To_String(TimeGenerated, 'yyyy-MM-ddThh:mm:ss')"
		If InStr(@PRODUCTTYPE," 2000") Or InStr(@PRODUCTTYPE," XP") Or InStr(@PRODUCTTYPE," 2003")
			$What = "Case EventID When 528 Then 'Logon' When 551 Then 'Logoff' END, To_String(TimeGenerated, 'yyyy-MM-ddThh:mm:ss')"
			$What = $What+", RESOLVE_SID(SID), SID"
			$Where = "EventID = 551 Or EventID = 528 AND (EXTRACT_TOKEN(Strings,3,'|')='2' Or EXTRACT_TOKEN(Strings,3,'|')='10') And EXTRACT_TOKEN(Strings,4,'|') like 'User32%'"
		Else
			$What = "Case EventID When 4624 Then 'Logon' When 4647 Then 'Logoff' END, To_String(TimeGenerated, 'yyyy-MM-ddThh:mm:ss')"
			$What = $What+", Case EventID When 4624 Then RESOLVE_SID(EXTRACT_TOKEN(Strings,4,'|'))"
			$What = $What+" When 4647 Then RESOLVE_SID(EXTRACT_TOKEN(Strings,0,'|')) END"
			$What = $What+", Case EventID When 4624 Then EXTRACT_TOKEN(Strings,4,'|') When 4647 Then EXTRACT_TOKEN(Strings,0,'|') END"
			$Where = "EventID = 4647 Or (EventID = 4624 AND (EXTRACT_TOKEN(Strings,8,'|')='2' Or EXTRACT_TOKEN(Strings,8,'|')='11')"
			$Where = $Where+" And EXTRACT_TOKEN(Strings,9,'|') like 'User32%'"
			$Where = $Where+" And EXTRACT_TOKEN(Strings,12,'|')='{00000000-0000-0000-0000-000000000000}')"
		EndIf
		$Data = LogToDataTable($oLogQuery,"Security","UserLogs",$What,$Where,$Order)
	EndIf
EndIf

Function LogToDataTable($oLogQuery, $Source, $Checkpoint, $sFields, Optional $Criteria, $Order)
		
	Dim $oEventLog, $oRecordSet,$Query
	$oEventLog = CreateObject("MSUtil.LogQuery.EventLogInputFormat")
	$oEventLog.iCheckPoint = %windir% + "\system32\logs\" + $Checkpoint + ".lpc"
	If Not Exist(%windir%+"\system32\logs\")
		MD %windir%+"\system32\logs\"
	EndIf
	$Query = "Select Distinct "+$sFields+" from "+$Source+IIf($Criteria," where "+$Criteria,"")+IIf($Order," order by "+$Order,"")
	$oRecordSet = $oLogQuery.Execute($Query, $oEventLog)
	While Not $oRecordSet.atEnd
		$LogToDataTable = Push($LogToDataTable, Split($oRecordSet.getRecord.toNativeString(Chr(1)), Chr(1)))
		$oRecordSet.moveNext
	Loop
		
EndFunction
;endregion

Function Push($a,$s)
	
	Dim $i
	$i = UBound($a)+1
	ReDim Preserve $a[$i]
	$a[$i] = $s
	$Push = $a
	
EndFunction