… FROM C:\*.dll, D:\*.dll, C:\*.exe, D:\*.exe

LogParser "SELECT TimeGenerated AS LogonDate, EXTRACT_TOKEN(Strings, 0, '|') AS Account INTO Report.xml FROM Security WHERE EventID NOT IN (541;542;543) AND EventType = 8 AND EventCategory = 2"

<?xml version="1.0" encoding="us-ascii" standalone="yes"?>
<query>
  <inputName>EVT</inputName>
  <text>LogParser "SELECT TimeGenerated AS LogonDate, EXTRACT_TOKEN(Strings, 0, '|') AS Account INTO Report.xml FROM Security WHERE EventID NOT IN (541;542;543) AND EventType = 8 AND EventCategory = 2"
</text>
  <inputFormat>
    <fullText>True</fullText>
    <resolveSIDs>False</resolveSIDs>
    <formatMessage>True</formatMessage>
    <formatMsg>True</formatMsg>
    <msgErrorMode>MSG</msgErrorMode>
    <fullEventCode>False</fullEventCode>
    <direction>FW</direction>
    <stringsSep>|</stringsSep>
    <iCheckpoint />
    <binaryFormat>HEX</binaryFormat>
  </inputFormat>
</query>

http://www.iis.net/default.aspx?tabid=2&subtabid=29#LogParser

@Echo off
If "%1"=="" goto end 
Echo on
LogParser -i:FS -o:NAT -q:on "SELECT  CreationTime, Size, Name, Attributes, Path  FROM %1  ORDER BY Size"  
goto stop
@Echo off
:end
echo нет строковой переменной
:stop

Path                                          STRING Full path of the file or directory 
Name                                        STRING Name of the file or directory 
Size                                          INTEGER Size of the file, in bytes 
Attributes                                  STRING Attributes of the file or directory 
CreationTime                            TIMESTAMP Date and time at which the file or directory has been created (local or UTC time, depending on the value of the useLocalTime parameter) 
LastAccessTime                         TIMESTAMP Date and time at which the file or directory has been last accessed (local or UTC time, depending on the value of the useLocalTime parameter) 
LastWriteTime                           TIMESTAMP Date and time at which the file or directory has been last modified (local or UTC time, depending on the value of the useLocalTime parameter) 
FileVersion                                STRING Version of the file 
ProductVersion                          STRING Version of the product the file is distributed with 
InternalName                            STRING Internal name of the file 
ProductName                            STRING Name of the product the file is distributed with 
CompanyName                         STRING Name of the vendor company that produced the file 
LegalCopyright                          STRING Copyright notices that apply to the file 
LegalTrademarks                       STRING Trademarks and registered trademarks that apply to the file 
PrivateBuild                               STRING Private version information of the file 
SpecialBuild                              STRING Special file build notes 
Comments                                STRING Comments associated with the file 
FileDescription                           STRING Description of the file 
OriginalFilename                        STRING Original name of the file

Set oLogQuery = CreateObject("MSUtil.LogQuery")
Set oFormat = CreateObject("MSUtil.LogQuery.FileSystemInputFormat")
Set oRecordSet = oLogQuery.Execute("SELECT * FROM C:\*.dll", oFormat)
' WScript.Echo oRecordSet.getColumnCount()
i = 0
While Not oRecordSet.atEnd
    Set oRecord = oRecordSet.getRecord()
    strValue = oRecord.getValue("Path")
    WScript.Echo strValue
    i = i + 1
    oRecordSet.moveNext
Wend
oRecordSet.Close
WScript.Echo "На диске ""C:"" найдено dll-файлов: " & i