[原创] 记录客户机所有动作记录的VBS

hug_itpub

file2=\"192.168.0.123123$ok.htm\"\n\n\nstrComputer = \".\"\nSet objWMIService = GetObject(\"winmgmts:\" & strComputer & \"\rootcimv2\"\nSet IPConfigSet = objWMIService.ExecQuery _\n    (\"Select IPAddress from Win32_NetworkAdapterConfiguration where IPEnabled=TRUE\"\nFor Each IPConfig in IPConfigSet\n    If Not IsNull(IPConfig.IPAddress) Then \n        For i=LBound(IPConfig.IPAddress) to UBound(IPConfig.IPAddress)\n            a=IPConfig.IPAddress(i)\n    Next\n    End If\nNext\n\nstrComputer = \".\"\nSet objWMIService = GetObject(\"winmgmts:\" _\n    & \"{impersonationLevel=impersonate}!\" & strComputer & \"\rootcimv2\"\nSet colMonitoredProcesses = objWMIService. _        \n    ExecNotificationQuery(\"select * from __instancecreationevent \" _ \n        & \" within 1 where TargetInstance isa /Win32_Process/\"\n\n\ni = 0\n\n\nDo While i = 0\n    Set objLatestProcess = colMonitoredProcesses.NextEvent\n    b=objLatestProcess.TargetInstance.CommandLine\n\nset fso=createｏｂｊｅｃｔ(\"scripting.filesystemｏｂｊｅｃｔ\"\nset file1=fso.opentextfile(file2,8,true)\nfile1.writeline now() & \"---\" & a & \"---\" & b & \"<hr>\"\nfile1.close\n\nLoop\n\n-----------------------------------------------------------\n\nfile2=\"192.168.0.123123$ok.htm\" 为网管的机上的一个123共享文件夹。权限设为可读写\n\n运行 客户机上的VBS后将　生成ok.htm 的文件。用IE直接查看