Hello I have a problem with a script, I would like the following from this script. First of all I want to create a folder with the month specific to my computer and in that folder to events logs,but save only application event and system event without the security even if the script is run with admin rights nothing happens. Bellow is my script

@echo off
rem Script starts here
rem Timestamp Generator
for /f "delims=" %%a in ('wmic OS Get localdatetime  ^| find "."') do set "dt=%%a"
:: Format the WMIC command output in YY_MM_DD_hr_mn format
set "YY=%dt:~0,4%"
set "MM=%dt:~4,2%"
set "DD=%dt:~6,2%"
set "hr=%dt:~8,2%"
set "mn=%dt:~10,2%"
:: Format the MM (month-number) to display the month-name
if %MM%==01 set MM=Ianuarie
if %MM%==02 set MM=Februarie
if %MM%==03 set MM=Martie
if %MM%==04 set MM=Aprilie
if %MM%==05 set MM=Mai
if %MM%==06 set MM=Iunie
if %MM%==07 set MM=Iulie
if %MM%==08 set MM=August
if %MM%==09 set MM=Septembrie
if %MM%==10 set MM=Octombrie
if %MM%==11 set MM=Noiembrie
if %MM%==12 set MM=Decembrie
set "today_date_time=%MM%_%YY%"
echo %today_date_time%
mkdir .\%today_date_time%
rem Set the timestamp format
wevtutil epl System %MM%_%YY%\system.evtx
wevtutil epl Application %MM%_%YY%\application.evtx
wevtutil epl Security %MM%_%YY%\security.evtx
wmic nteventlog where filename='system' cleareventlog
wmic nteventlog where filename='application' cleareventlog
wmic nteventlog where filename='security' cleareventlog
rem End of Script

CodePudding user response：

Here's a re-written example without all of the WMIC.exe stuff, as per your commented request:

@Rem Start of script.
@Echo Off
SetLocal EnableExtensions
Rem End script if end user is not running with the required permissions.
%SystemRoot%\System32\reg.exe Query "HKU\S-1-5-19" 1>NUL 2>&1 || GoTo :EOF
Rem Add the current directory to the stack and make this scripts location the current directory.
PushD "%~dp0."
Rem Generate a datestamp variable with a string formatted as yy_MMMM.
Set "DateStamp="
For /F %%G In ('%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile "Get-Date -F 'yy_MMMM'" 2^>NUL') Do Set "DateStamp=%%G"
Rem End script if datestamp variable was not defined.
If Not Defined DateStamp GoTo :EOF
Rem Backup and clear event logs.
If Not Exist "