Recently, I asked Michael Niehaus would it be a good idea to send Events, that normally go to EventShare, to SCCM as a status message. Michael's response was that the challenge was Windows PE.
But still, if you're using MDT Scripting framework for all your VB Scripts (I do, and you should too, I don't see the reason why you should not :)), instead of reinventing the wheel and scanning through the logs or writing some kind of custom receiver for Event files - why not writing it directly to SCCM database as a status message using client API? This is not going to work in Windows PE, but in live OS it will work just fine.
I attached two files.
CustomUtility.vbs is an include file, add it to your WSF under ZTIUtility.vbs, like this:
<script language="VBScript" src="ZTIUtility.vbs"/>
<script language="VBScript" src="CustomUtility.vbs"/>
<script language="VBScript" src="ZTIDataAccess.vbs"/>
So, now you can call something like this in your script:
oLogging2.CreateEvent 78002, LogTypeInfo, "Migrated", Array(sDomainName + "\" + sAccountName, sSID, sMail, oEnvironment.Item("TargetDomain") + "\" + sTargetAccount, sTargetSID, sTargetGUID, sDisplayName, sProfileImagePath)
There are two parts of SCCM Status message - Attributes and Insert Strings. For attributes, this is how we re-purpose them:
400 is generally PackageID
401 is generally AdvertID
402 is generally CollectionID, but we use it for EventID
403 is generally User Account initiating action, but we use it for script name
404 is generally a distribution point, but we use it for the text message
The array of parameters (last input parameter) will be added as Insert Strings.
So, in our example, we know, that first is Old account, then goes SID, etc. Here is an example of query that will retrieve all those events for us (it's also attached to this post):
SELECT MachineName, DATEADD(ss,@__timezoneoffset,Time), DisplayName,OldAccount, NewAccount, EMail, Profile, Migrated.RecordID
(select A.RecordID, A.MachineName, A.Time from dbo.v_StatusMessage A,
A.RecordID = B.RecordID AND
A.MessageID = 39997 AND
B.AttributeID = 402 AND
B.AttributeValue = '78002'
(select InsStrValue as DisplayName, RecordID from v_StatMsgInsStrings where InsStrIndex = 6) DisplayName,
(select InsStrValue as OldAccount, RecordID from v_StatMsgInsStrings where InsStrIndex = 0) OldAccount,
(select InsStrValue as NewAccount, RecordID from v_StatMsgInsStrings where InsStrIndex = 3) NewAccount,
(select InsStrValue as EMail, RecordID from v_StatMsgInsStrings where InsStrIndex = 2) EMail,
(select InsStrValue as Profile, RecordID from v_StatMsgInsStrings where InsStrIndex = 7) Profile
where Migrated.RecordID = DisplayName.RecordID AND
Migrated.RecordID = OldAccount.RecordID AND
Migrated.RecordID = NewAccount.RecordID AND
Migrated.RecordID = EMail.RecordID AND
Migrated.RecordID = Profile.RecordID
ORDER BY Time DESC
Do you like it?