Using WMI to Monitor AD

Scripting Group Monitoring
The script to monitor Windows group modifications starts with command-line parameter definitions, as the code at callout A in Listing 1 shows. The script then includes a series of helper functions to handle some specific tasks during the script's execution. The helper functions, which callout B references, are

• the GenerateHTML() function, which generates an HTML representation of the information contained in a WMI instance
• the PauseScript() function, which executes a script pause by displaying a pop-up message on the screen
• the SendMessage() function, which uses Collaboration Data Objects (CDO) statements to create and send an SMTP message to a specific mailbox
• the TinyErrorHandler() function, which handles script execution errors

Next, the script creates a series of WMI objects, as the code at callout C shows. These objects establish the WMI connection to the root\directory\LDAP namespace and submit the WQL event query. By default, the script creates an objWMIdateTime object from the SWbemDateTime WMI COM object. This COM object, which is available only under Windows Server 2003 and Windows XP, converts the Distributed Management Task Force (DMTF) datetime format to a readable string. (More information about the DMTF datetime format is available at http://msdn.microsoft.com/library/en-us/wmisdk/wmi/date_and_time_format.asp.) If you must run the code under Win2K, you must change the line

<object progid="WbemScripting
.SWbemDateTime" id="objWMIDateTime" />

to . . .