Wmi script to find out the time when the user was added to local administration group

Hi Friends,
i need a script/query based on wmi/wql that find out the time when the user was added to local administration group on this computer
Regards
Tanoj
OSLM ENGINEER - SCCM 2007 & 2012

WMI does not keep security information.
Unless you have enabled auditing, this information is not retained in any way.
If auditing is enabled, you can write a powershell script to look for the specific event in the eventlog. More specifically, you should look for all security events with id 4732 containing the group.
this one command does the trick
get-eventlog -logname security -instanceid 4732 -message *administrators*
https://technet.microsoft.com/en-us/library/dd772663(v=ws.10).aspx
MCP/MCSA/MCTS/MCITP

Similar Messages

How to find out the time when the ASE started?

Normally, ASE not reboot for production. Only for maintenance or performance tuning, maybe need to reboot ASE.
Question is how to find out the time when ASE was started?
one way maybe is check errorlog. Any more simple way no need to login to server OS?

Hi Kent,
In ASE 12.5 and up, you can do 'select @@boottime' For older releases, a general method is 'select crdate from sysdatabases where dbid=2'
1> select @@boottime, crdate from sysdatabases where dbid=2
2> go
crdate
Jul 15 2014 9:19AM Jul 15 2014 9:19AM
(1 row affected)
Cheers
Dan

How to record the time when a checkbox was checked?

I would like to insert the value of NOW() at the moment when a checkbox is changed from unchecked to checked.
Having a programming background but now spreadsheet background, I can't find out how to do this seemingly easy thing.

Hello
It may appears as a
• simple task:
if the checkbox is B2,
in C2 enter =IF(B2=TRUE,NOW(),"")
The time will be displayed when you will check the box
• not so simple
the time displayed in c2 is a "living" one.
It will change each time when the sheet will recalculate. So the value will not be accurate.
Here is a script which will give an accurate result:
Enregistrer le script en tant qu'Application ou Progiciel : checkandtime.app
déplacer l'application créée dans le dossier
<VolumeDeDémarrage>:Users:<votreCompte>:Library:Scripts:Applications:Numbers:
Il vous faudra peut-être créer le dossier Numbers et peut-être même le dossier Applications.
Copier le contenu de la cellule "pseudo case à cocher" dans le presse-papiers.
Sortez de la cellule puis cliquez sur celle-ci
menu Scripts > checkandtime
Si vous travaillez avec Mac OS X 10.4.x, le script collera " " ou "X"
Si vous travaillez avec Mac OS X 10.5.x, le script collera un caractère Unicode coché/pas coché
S'il colle coché il colle également la date/heure dans la cellule adjacente
+++++++
Save the script as an Application or an Application Bundle: checkandtime.app
Move the newly created application into the folder:
<startup Volume>:Users:<yourAccount>:Library:Scripts:Applications:Numbers:
Maybe you would have to create the folder Numbers and even the folder Applications by yourself.
Copy the contents of the "fake checkbox" cell in the clipboard
Exit from the cell then click once in it.
menu Scripts > checkandtime
If you work with MacOS X 10.4.x the script will paste " " or "X"
If you work with MacOS X 10.5.x the script will paste an Unicode character: checked or unchecked
If it paste checked, it paste also the current date_time in the adjacent cell.
Yvan KOENIG le 27 mars 2008
--(SCRIPT checkandtime.app]
on run
set theApp to "Numbers"
try
set txtDatas to the clipboard as Unicode text
on error (*
The clipboard was empty *)
return
end try
log txtDatas
if txtDatas contains tab then return
set txtDatas to my applyMask(txtDatas, theApp)
log txtDatas
set the clipboard to txtDatas
my pasteIn(theApp)
end run
--=============
on pasteIn(the_App)
tell application the_App to activate
tell application "System Events" to tell (first process whose title is the_App) to keystroke "v" using {command down}
end pasteIn
--=============
on applyMask(t, the_App)
try
set v to (system attribute "sys1")
if (v's class is integer) then
set v to (v as string) & "." & (system attribute "sys2") & "." & (system attribute "sys3")
else
error
end if
on error
set v to (system attribute "sysv")
set v to ((v div 4096 * 10 + v mod 4096 div 256) as string) & "." & v mod 256 div 16 & "." & v mod 16
end try
if v < "
set faux to " "
else
set vrai to character id 9745
set faux to character id 9723
end if
if t is vrai then
return faux & tab & " "
else
return vrai & tab & (current date) as text
end if
end applyMask
--=============
--[/SCRIPT]
Yvan KOENIG (from FRANCE jeudi 27 mars 2008 14:32:26)

The time when the PI doc is counted ,I want see the hour and minutes ,

HI experts ,
How can I find when the physical inventory doc had been created ,counted and posted , by hour and minutes , the date is not enough .
Thanks in advance .

we use MI31 for create Physical inventory doc.
as a matter of fact , what I most want to know is when the count quantity is entered by hour and minutes , because the book quantity in the Physical inventory doc is extract from MBEW table when the count quantity is first entered.After that the book quantity never updated . So it's necessary to konw the exact time when the count quantity is entered , then we can do the right analysis of physical inventory difference.

How to find out last time, when AE was started?

Hi guys!
I need to find out, when was our AE last time started.. Is it possible w/o Visual Admin?
Thank you!
Olian

Hi Olian,
You need to go into RWB.
Inside RWB go to Component Monitoring -> Adapter Engine -> Adapter monitoring. You will see all the adapter listings there.
Thanks
Aashish Sinha
PS : Reward points if Helped

Displaying the time when the iphone is asleep

Sincere apologies if this has been posted elsewhere.
On my ancient Nokia phone, I was able to have the time displayed when the phone was asleep. Is this possible on the iphone? I don't want a nightstand type app, because I'm hoping not to use up too much battery. It would be handy to have the time displayed so I can quickly glance at the phone to check the time as it sits on my desk.

There are different LCD technologies - with older ones the image could be visible (but poorly) without backlighting (reflective). Newer technology (transmissive) shows better images with greater viewing angles but require backlighting.
iPhone's LCD seems to be fairly viewable in bright sunlight, so I'd be willing to say that it might be possible to show a readable image (displaying time, at least) without the backlighting, but that capability would have to be supported by the phone (display image, turn off backlighting) and currently it is not.

Changing the time when the commitment is created.

Hi everybody!!
Does anybody now if the action of requesting a SC can built up a commitment. If the approver reject the SC the commitment should be rejected. In the PO creation the commitment shouldn't be created.
Is that possible? if it is, can anybody give me some idea how it could be done.
thanks for your attention
Best regards
Jorge

Hi Jorge,
We find the same issue in here. I have checked this forum, and get notes 900825 in which it is mentioned that the solution is possible using Badi only (not changing SAP standard). But unfortunately it is considered consulting issue and SAP would charge for this.
I was thinking that perhaps we can utilize BADI triggered during SC creation, in which the BADI should be able to call FM in backend which can be used to create commitment. This commitment should be deleted afterward whenever the SC is rejected or the PO has been created as follow-on document (another BAdi should be utilized which will need to call FM to change the commitment).
However I'm stuck on the function module that we can use in backend. For anyone reading this post, can you help?
Best regards,
Yosea

The time when the BADI implementation class really initialize.

when I debug the cl_exithanler=>get_instance, I found that it returns the class name as: CL_IM_EX..., not the implementation class name begin with: ZCL_IM... which is created by me. So when does the BADI implementation class really initialize?

It's not a macro, as Uwe showed you. Inside your Constructor method just enter the following code:
break sy-uname
Because of the '.' in your name you cannot use
break yuan.gan.
I am suprised to see that as a user name like that though.

To find time when the user was dropped oracle

Hi Experts,
I have query from my auditor that will it be possible to find the time when the oracle user was dropped .
Vesrion oracle 10g,11g
Can we find it through audit trail or there is some dynamic performacne view which keeps this information.
Or other wise we have to create some trigger manually to capture the time if so then please provide the details of the same
A quick responce will be helpfull ....

See here : 11.2.0.1 Windows XP
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
SQL> select username from dba_audit_trail
2 where
3 action=53;
no rows selected
SQL> show parameter audit;
NAME                                 TYPE        VALUE
audit_file_dest                      string      E:\APP\SERVERROOM\ADMIN\ORCL\A
                                                 DUMP
audit_sys_operations                 boolean     FALSE
audit_trail                          string      DB_EXTENDED
SQL> audit drop user;
Audit succeeded.
SQL> create user test identified by test;
User created.
SQL> drop user test;
User dropped.
SQL> column sql_text for a50;
SQL> set line 200;
SQL> select username,
2 timestamp,
3 sql_text
4 from dba_audit_trail
5 where
6 action=53
7 /
USERNAME                       TIMESTAMP SQL_TEXT
SCOTT                          30-APR-12 drop user test
SQL>So, answer is action=53 in dba_audit_trail for drop user and for specific user just add like operator with sql_text column. Means, scott user droped the test user on 30-APR-12.
If you wish to know the meaning of action column of dba_audit_trail then see below link :
http://docs.oracle.com/cd/B19306_01/server.102/b14237/dynviews_2088.htm#g1432037
command.v$session = action.dba_audit_trail
If this answer your question, please close the thread, else continue.
Regards
Girish Sharma

Time when the waveform value cross a determined level

Hi all,
I'm using PCI-5112 with Labvew to capture a waveform and i'm getting a triangle form waveform type. How to find the time when the waveform value cross some predetermined values. To put it more clearly, I attached a picture. In my picture, I want to know TH (time interval when the Y value cross 100), TM ( time interval when the Y value cross 50), TL (time interval when the Y value cross 20). How to put these measurements through Labview program? Any clue or example would be very helpful. Thx
Attachments:
description.jpg ‏22 KB

You can do this using the built-in NI-SCOPE functions or the LabVIEW pulse waveform measurements VIs by tweaking the reference levels appropriately. However, given the noise level in your signal, you may not be happy with the result, since these measurements are done essentially on a point-to-point basis. A more robust option is to find the approximate location of the level crossing, take N points on either side of it, do a simple curve fit to this data, then use the curve fit to determine the actual level crossing. A line fit would work on the first part of your curve, an exponetial or parabolic fit on the second. A further optimization would be to use a robust fitting method, but it does not look like you need to go that far.
If you need more details on any of these methods, let us know.
This account is no longer active. Contact ShadesOfGray for current posts and information.

My contacts wiped out when another phone was added to account

Sister got an iphone and wiped out my contacts when her phone was added to the apple acco

laceyones, that doesn't sound like fun! I have seen this happen before when people share an Apple ID. I would suggest you set your sister up with her own personal Apple ID. In regards to restoring your contacts, restore your contacts from Backup Assistant Plus, if you had them backed up. You could also possibly restore your contacts from your iCloud or iTunes backup.
LindseyT_VZW
Follow us on Twitter @VZWSUPPORT

Can we find out the date/time when the datafile last extended?

Hello all,
Can we find out the date/time when the datafile last extended?
Is it possible to find out from the alert.log file?
Correct me if I am worng?
Thanks in advance
Himanshu

In continuation with the earlier post, can you tell me what sort of entry should be search if the above information is available in the alert.log file?
Thanks
Himanshu

HT1391 Hi can anyone tell me how to find out what and when my last purchases were made from the App Store ? I think my kids used all my credit

Hi can anyone tell me how to find out what and when my last purchases were made from the App Store ? I think my kids used all my credit

.from iTunes, go to View > Show sidebar
From sidebar > Itunes Store > Click top left on your Apple ID email address > Account > ...scroll down > Purchase History > View All

Script to find out table and index candidates to keep in the buffer pool

I am looking for a script to find out tables and indexes to keep in the buffer pool.
Could you help me on this ?
thanks...
Markus

this is more of a open question. As you know ur data well. We do not know whats ur data. cachin tables in buffer pool is okay, but it might age out after not being used...instead you can use the KEEP POOL...to cache small tables/popular tables into the keep pool...as keep pool guarantees full caching .....
here are some links on keep pool cacheing
http://download.oracle.com/docs/cd/B19306_01/server.102/b14211/memory.htm#sthref410
http://www.dba-oracle.com/oracle_tips_cache_small_fts.htm
http://www.dba-oracle.com/t_script_automate_keep_pool_tables_indexes.htm
http://www.dba-oracle.com/oracle_news/news_caching_keep_pool_large_objects_clob_blob.htm
Edited by: user630084 on Apr 8, 2009 5:48 AM

My iphone 3GS needs updating but when i plug it into itunes it reads and said the activation is out of time and the phone keeps going off?

my iphone 3GS needs updating but when i plug it into itunes it reads and said the activation is out of time and the phone keeps going off?

jadekinsey wrote:
when i plug it into itunes it reads and said the activation is out of time
No such message occurs.
Are you trying to state that it says "Unable to activate"?
If so, this typically indicates the device has been hacked or jailbroken. If that is the case, no support can be provided via these forums.

Wmi script to find out the time when the user was added to local administration group

Similar Messages

Maybe you are looking for