WMI: Win32_Account class

hello!

one of our vbs scripts monitors changes in win32_account class:

"
strcomputer = "."

set objwmiservice = getobject("winmgmts:{(security)}\\" & strcomputer & "\root\cimv2")
set objeventsource = objwmiservice.execnotificationquery ("select * __instanceoperationevent within 10 targetinstance isa 'win32_account' and targetinstance.localaccount=true")

...

"

the problem in spite of adding targetinstance.localaccount=true this code still captures win32_account class's changes in domain of our enterprise domain tree, when connected "." (locally).

this page https://msdn.microsoft.com/ru-ru/library/windows/desktop/aa394061%28v=vs.85%29.aspx says:

"the win32_account abstract wmi class contains information user accounts , group accounts known computer system running windows. user or group names recognized windows domain descendants (or members) of class."

q1: definition mean connection local win32_account class (".") capture not local domain account modifications (if computer member of domain) well, because user or group names recognized windows domain descendants (or members) of class?  - that's see in network.

q2: should narrow down scope of command single domain - city2.enterprise.local?

thank in advance,

michael

hi michael,

to solve issue related vbscript, recommend can post in the official scripting guys forum more efficient support:

https://social.technet.microsoft.com/forums/scriptcenter/en-us/home?forum=itcg

since windows powershell can used query wmi class, , tested script "localaccount" below, can filter local user account:

get-wmiobject -class win32_account -filter "localaccount = true"

we can specify remote computername in -computername parameter.

if there else regarding issue, please feel free post back.

best regards,

anna wang

---

please remember mark replies answers if , unmark them if provide no help. if have feedback technet support, contact tnmff@microsoft.com

Windows Server  >  Windows Server 2012 General