JScript: отлов выключения компьютера

set wshshell=CreateObject("wscript.shell")
set fso = CreateObject("Scripting.FileSystemObject")

call wshshell.run("%comspec% /c mofcomp -N:root\cimv2 %SystemRoot%\system32\Wbem\Wbemcons.mof&&pause",9,-1)
call wshshell.run("%comspec% /c mofcomp -N:root\subscription %SystemRoot%\system32\Wbem\scrcons.mof&&pause",9,-1)

Computer="."
Set Service = GetObject("winmgmts:\\" & Computer & "\Root\CIMV2")

mondel(Service)

Set oFilter = Service.Get("__EventFilter").SpawnInstance_
oFilter.Name = "Мой монитор выключения и перезагрузки"
oFilter.QueryLanguage = "WQL"
oFilter.Query = "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_NTLogEvent'  AND TargetInstance.Logfile = 'System' and TargetInstance.SourceName= 'USER32' and TargetInstance.EventCode = '1074' or TargetInstance.EventCode = '1076'"
oFilter.Put_

FolderMon="C:\монитор выключения и перезагрузки"
FileMon=FolderMon & "\Мой монитор выключения и перезагрузки лог.txt"
if NOT fso.FolderExists then fso.CreateFolder FolderMon

Set oConsumer = Service.Get("LogFileEventConsumer").SpawnInstance_
oConsumer.Name = "Мой монитор выключения и перезагрузки лог"
oConsumer.FileName = FileMon
oConsumer.Text = "Компьютер: %TargetInstance.ComputerName%, Сообщение: %TargetInstance.Message%, Запись: %TargetInstance.RecordNumber%, Пользователь: %TargetInstance.User%, Источник: %TargetInstance.SourceName%, Время события:  %TargetInstance.TimeGenerated%, Время записи: %TargetInstance.TimeWritten%"
oConsumer.Put_
Set oFilter = Service.Get("__EventFilter.Name='Мой монитор выключения и перезагрузки'")
Set oConsumer = Service.Get("LogFileEventConsumer.Name='Мой монитор выключения и перезагрузки лог'")
Set oBinding = Service.Get("__FilterToConsumerBinding").SpawnInstance_
oBinding.Filter = oFilter.Path_
oBinding.Consumer = oConsumer.Path_
oBinding.Put_

SMTP="mail.n-d.ru"
From="ginzburg@n-d.ru"
Too="it@n-d.ru"
Subj="""Мои логи выключения и перезагрузки на "" & now"
Body=Subj
SendInterval=86400 * 1000

Script="Call SendPost(""" & SMTP & """, """ & Too & """, """ & From & """, " & Subj & ", " & Body & "):" & _
"Function SendPost(strSMTPServer, strTo, strFrom, strSubject, strBody):" & _
"    Set iMsg = CreateObject(""CDO.Message""):" & _
"    Set iConf = CreateObject(""CDO.Configuration""):" & _
"    Set Flds = iConf.Fields:" & _
"    Flds.Item(""http://schemas.microsoft.com/cdo/configuration/sendusing"") = 2:" & _
"    Flds.Item(""http://schemas.microsoft.com/cdo/configuration/smtpserver"") = strSMTPServer:" & _
"    Flds.Item(""http://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout"") = 10:" & _
"    Flds.Update:" & _
"    iMsg.Configuration = iConf:" & _
"    iMsg.To = strTo:" & _
"    iMsg.From = strFrom:" & _
"    iMsg.Subject = strSubject:" & _
"    iMsg.TextBody = strBody:" & _
"    iMsg.AddAttachment """ & FileMon & """:" & _
"    iMsg.Send:" & _
"End Function"

Set Service=GetObject("winmgmts:\\" & computer & "\root\subscription")

mondel(Service)

Set oTimer=Service.Get("__IntervalTimerInstruction").SpawnInstance_
oTimer.IntervalBetweenEvents = SendInterval
oTimer.TimerId = "Мой супертаймер для выключения и перезагрузки"
oTimer.Put_
Set oFilter=Service.Get("__EventFilter").SpawnInstance_
oFilter.Name = "Мой отправитель логов выключения и перезагрузки"
oFilter.QueryLanguage = "WQL"
oFilter.Query = "SELECT * FROM __TimerEvent WHERE TimerID='Мой супертаймер для выключения и перезагрузки'"
oFilter.Put_
Set oScript=Service.Get("ActiveScriptEventConsumer").SpawnInstance_
oScript.Name = "Мой скрипт отправителя логов выключения и перезагрузки"
oScript.ScriptText = Script
oScript.ScriptingEngine = "VBScript"
oScript.Put_
Set oFilter = Service.Get("__EventFilter.Name='Мой отправитель логов выключения и перезагрузки'")
Set oConsumer = Service.Get("ActiveScriptEventConsumer.Name='Мой скрипт отправителя логов выключения и перезагрузки'")
Set oBinding=Service.Get("__FilterToConsumerBinding").SpawnInstance_
oBinding.Filter=oFilter.Path_
oBinding.Consumer=oConsumer.Path_
oBinding.Put_

sub mondel(objService)
    on error resume next
    for each c in objService.ExecQuery("select * from __EventFilter")
        if instr(lcase(c.name),"мой") then
            msgbox c.name
            c.Delete_
        end if
    next
    for each c in objService.ExecQuery("select * from __IntervalTimerInstruction")
        if instr(lcase(c.TimerId),"мой") then
            msgbox c.TimerId
            c.Delete_
        end if
    next
    for each c in objService.ExecQuery("select * from __TimerEvent")
        if instr(lcase(c.name),"мой") then
            msgbox c.name
            c.Delete_
        end if
    next
    for each c in objService.ExecQuery("select * from LogFileEventConsumer")
        if instr(lcase(c.name),"мой") then
            msgbox c.name
            c.Delete_
        end if
    next
    for each c in objService.ExecQuery("select * from ActiveScriptEventConsumer")
        if instr(lcase(c.name),"мой") then
            msgbox c.name
            c.Delete_
        end if
    next
    for each c in objService.ExecQuery("select * from __FilterToConsumerBinding")
        if instr(lcase(c.Consumer),"мой") then
            msgbox c.Consumer
            c.Delete_
        end if
    next
    on error goto 0
end sub

WScript.Quit()

On Error Resume Next
Dim mywriteFile,strComputer,objWMIService,myobj,myobjFile
Set myobj = CreateObject("Scripting.FileSystemObject")
If Not myobj.FileExists("c:\SCOMServers.txt") Then
Wscript.echo " Input File C:\System.txt is missing. Script cannot proceed without Input File"
Wscript.quit
End If
Set myobjFile = myobj.OpenTextFile("C:\SCOMServers.txt", 1)
IDCount = 1
Do Until myobjFile.AtEndOfStream
strcomputer = myobjFile.ReadLine
            Set mywriteFile = myobj.CreateTextFile("C:\report" & strcomputer &".csv",2)
            mywritefile.writeline "Computer Name" & "," & "Event Message" & "," & "Record Number" &","&"Source Name" &"," &"Event Type" &"," &"Time Generated" &","&"Time Written" &"," & " User"
            Set objWMIService = GetObject("winmgmts:" _  
            & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
            Set colLoggedEvents = objWMIService.ExecQuery _
            ("Select * from Win32_NTLogEvent Where Logfile = 'System' and SourceName= 'USER32' and EventCode = '1074' or EventCode = '1076'" )
            For Each objEvent in colLoggedEvents  
      '            Wscript.Echo "Computer Name: " & objEvent.ComputerName
      '            Wscript.Echo "Message: " & objEvent.Message  
      '            Wscript.Echo "Record Number: " & objEvent.RecordNumber  
      '            Wscript.Echo "Source Name: " & objEvent.SourceName
      '            Wscript.Echo "Event Type: " & objEvent.Type  
      '            WScript.Echo "TimeGenerated: " & WMIDateStringToDate(objEvent.TimeGenerated)
       '            WScript.Echo "TimeWritten: " & WMIDateStringToDate(objEvent.TimeWritten)
      '            Wscript.Echo "User: " & objEvent.User
            mywritefile.writeline objEvent.ComputerName & "," & objEvent.Message & ",," & objEvent.RecordNumber &","& objEvent.SourceName & "," & objEvent.Type &"," & WMIDateStringToDate(objEvent.TimeGenerated) & "," & WMIDateStringToDate(objEvent.TimeWritten) & "," & objEvent.User
            Next
IDCount = IDcount + 1
loop
      

            Function WMIDateStringToDate(dtmDate)
            'WScript.Echo dtm:
            WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & _
            Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) _
            & " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2))
            End Function