I have done a simple script to check last modified on all files in a directory. This example will generate a local event if files are older then 2 months.

strComputer = "."
Const EVENT_WARNING = 2
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")Set colFileList = objWMIService.ExecQuery _
    ("ASSOCIATORS OF {Win32_Directory.Name='C:\'} Where " _
        & "ResultClass = CIM_DataFile")

For more settings, please see post.

This is a simple script that will check if a file exists, if not it will generate a warning event in the local event viewer. You can pick up that event with a rule from MOM. In this example, the script verify if C:\pagefile.sys exists.

Set objFSO = CreateObject(“Scripting.FileSystemObject”)

strFile = “C:\pagefile.sys”

If objFSO.FileExists(strFile) Then
    Set objFolder = objFSO.GetFile(strFile)
Else
    Const EVENT_WARNING = 2
    Set objShell = CreateObject(“Wscript.Shell”)
    objShell.LogEvent 2, strFile & ” is not accessible.”
End If

Last week me and some friends found a strange mismatch with a server that has remote desktop enable and the terminal service application computer group. I have done a script that will check a regkey (not the one in this example) and a service startup type. If the startup type is not auto, the script will change it and generate a information event in the local event viewer. It is a little bit strange script, but I am sure someone more that us can use it 🙂

The event that is generated in the local event viewer has event id 0 and the type is information

Unfortunately my WordPress theme dont really like long lines in scripts, so I have uploaded it as a file instead. You can download it here

I have done a script that will check two performance counters and generate an alert if both are over threshold values. It simple to add more performance counters and change the threshold values. I have test it on Windows Server 2003 and Window XP 32bit. Its fairly basic, but it will show you a way to generate an alert based on two or more performance counters.

strComputer = “.”
Set objWMIService = GetObject(“winmgmts:” _
& “{impersonationLevel=impersonate}!\\” & strComputer & “\root\cimv2”)
set objRefresher = CreateObject(“WbemScripting.SWbemRefresher”)
Set colItems = objRefresher.AddEnum _
(objWMIService, “Win32_PerfFormattedData_PerfOS_System”).objectSet
objRefresher.Refresh
For i = 1 to 2
For Each objItem in colItems

strProc = objItem.Processes
strCPUQL = objItem.ProcessorQueueLength

If strProc > 40 AND strCPUQL > 0 Then
Const EVENT_WARNING = 2
Set objShell = CreateObject(“Wscript.Shell”)
objShell.LogEvent 2, “Number of processer: ” & strProc & “. Processor Queue Lenght: ” & strCPUQL
End If
objRefresher.Refresh
Next
Next

1. Create a new script and paste the script source
2. Create a new event rule to run the script every X minute as respond
3. Create a new event rule to collect event ID 2 and event type of Warning
4. Commit configuration change

This script will check if a file in a share is accessible, if not, it will generate a local event.

strFile = "\\ntlcs\share\file_check.txt"
Set objFSO = CreateObject("Scripting.FileSystemObject")
If objFSO.FileExists(strFile) Then

1. Create a new script and paste the script
2. Create a new event rule to run the script every X minute as respond
3. Create a new event rule to collect event ID 2 and event type of Warning
4. Commit configuration change