Case by Case..

如何通过验证给远程计算机添加事件日志

偶尔在论坛里看到了这么个问题：

http://forums.microsoft.com/china/ShowPost.aspx?PostID=2651830&SiteID=15

EventLog组件没有提供验证的接口，在非域环境不方便通过远程计算机的验证。在网上搜了，这么一个常见的问题居然没有现成答案，OpenEventLog等API也没有验证参数……于是研究了一下Windows自带的EventCreate.exe的实现，原来是调用了WNetAddConnection2，依样画葫芦：

        [StructLayout(LayoutKind.Sequential)]
        private class NETRESOURCE
        {
            public int dwScope = 0;
            public int dwType = 0;
            public int dwDisplayType = 0;
            public int dwUsage = 0;
            public string lpLocalName = null;
            public string lpRemoteName = null;
            public string lpComment = null;
            public string lpProvider = null;
        };

        [DllImport("Mpr.dll", EntryPoint = "WNetAddConnection2", CallingConvention = CallingConvention.Winapi)]
        private static extern int WNetAddConnection2(NETRESOURCE lpNetResource, string lpPassword, string lpUsername, uint dwFlags);

        private void button1_Click(object sender, EventArgs e)
        {
            NETRESOURCE myNetResource = new NETRESOURCE();
            myNetResource.lpRemoteName = @"\\server\IPC$";

            int ret = WNetAddConnection2(myNetResource, "password", @"server\Administrator", 0);

            eventLog1.Source = "EventCreate";
            eventLog1.Log = "Application";
            eventLog1.MachineName = "server";
            eventLog1.WriteEntry("Test");
        }

走的RPC。Event Source需要事先创建好，目标机器的Remote Registry服务需要开启。

此外也可以考虑走WMI路线，具体没有详细研究……

posted on 2008-02-22 15:20:00 by TingWang  评论(2) 阅读(2954)