I downloaded the script that Listing 3 shows from Microsoft's TechNet Script Center. The script works, but it doesn't list events in the Security log. Is this a bug, or do I need to do something special to get the script to read the Security log?
You need to enable the Security privilege to read the Security log. You can enable the Security privilege as part of the Windows Management Instrumentation (WMI) connection string (also known as a moniker) passed to GetObject. To enable the Security privilege in the WMI connection string, simply replace the code at callout A in Listing 3 with the code that Listing 4 shows.
Notice that you must enclose the privilege in parentheses and insert a comma between the ImpersonationLevel setting and the list of privileges. To learn more about the format and structure of the WMI connection string, see "WMI Monikers," http://www.winscriptingsolutions.com, InstantDoc ID 20401.